QtWebEngineProcess[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

QtWebEngineProcess.exe
Size

24KB
MD5

bcc2f0b67c2a7ffb4211027b6b39e70a
SHA1

8b58a0f15040cc8ec9d2ac038573b30fdb18483f
SHA256

5c633de0829a5d7a26184a6157ee9929939f6d10c26b148fd6bc6408a51bd900
SHA512

a00dab9c56ce031db27a714120030f7e7a56d593e10f1bad68c1ba550714a6196a6243d00f1c2738207d75055415c98ef6fa6a2ae7b60d522da1bb16bdaf1bf0
SSDEEP

384:GSNuATkSs9F0b8LzHK/rI4fxCKm9p8/LlEnfePPLTTjg:V89NCrzEKokLGmzk

Score

1^/10

Malware Config

Signatures

Files

QtWebEngineProcess.exe
.exe windows x64

23d904c99c36cf567c0424efb7e1566d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:e9:57:9a:ab:76:3e:72:07:99:89:c6:89:d2:b4:2d
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

18/09/2017, 00:00

Not After

24/11/2020, 23:59

Subject

CN=The Qt Company Oy,O=The Qt Company Oy,L=Oulu,ST=Oulu,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b1:44:41:0a:d9:fd:a0:80:36:9a:e5:85:88:e8:22:f4:dc:ef:cb:7f
Signer

Actual PE Digest

b1:44:41:0a:d9:fd:a0:80:36:9a:e5:85:88:e8:22:f4:dc:ef:cb:7f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

qt5core

??0QCoreApplication@@QEAA@AEAHPEAPEADH@Z
??1QCoreApplication@@UEAA@XZ
??0QMessageLogger@@QEAA@PEBDH0@Z
?setFileName@QLibrary@@QEAAXAEBVQString@@@Z
?load@QLibrary@@QEAA_NXZ
?resolve@QLibrary@@QEAAP6AXXZPEBD@Z
??1QLibrary@@UEAA@XZ
??0QLibrary@@QEAA@PEAVQObject@@@Z
??1QString@@QEAA@XZ
?qErrnoWarning@@YAXHPEBDZZ
?warning@QMessageLogger@@QEBAXPEBDZZ
?windowsVersion@QSysInfo@@SA?AW4WinVersion@1@XZ

qt5webenginecore

?processMain@QtWebEngine@@YAHHPEAPEBD@Z

kernel32

WideCharToMultiByte
LocalFree
GetCommandLineW
RtlLookupFunctionEntry
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
CloseHandle
GetLastError
GetCurrentProcessId
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlVirtualUnwind

vcruntime140

_CxxThrowException
__std_exception_destroy
__std_exception_copy
__vcrt_InitializeCriticalSectionEx
memset
__C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_register_thread_local_exe_atexit_callback
exit
_exit
_configure_narrow_argv
_initterm_e
_c_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_seh_filter_exe
_initterm
_cexit
_get_narrow_winmain_command_line
_initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh
free
_set_new_mode
malloc

shell32

CommandLineToArgvW

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23d904c99c36cf567c0424efb7e1566d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

06:e9:57:9a:ab:76:3e:72:07:99:89:c6:89:d2:b4:2dCertificate

Extended Key Usages

Key Usages

b1:44:41:0a:d9:fd:a0:80:36:9a:e5:85:88:e8:22:f4:dc:ef:cb:7fSigner

Headers

DLL Characteristics

File Characteristics

Imports

qt5core

qt5webenginecore

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

shell32

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 780B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 88B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

06:e9:57:9a:ab:76:3e:72:07:99:89:c6:89:d2:b4:2d
Certificate

b1:44:41:0a:d9:fd:a0:80:36:9a:e5:85:88:e8:22:f4:dc:ef:cb:7f
Signer

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 780B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 88B