EpicWebHelper-Win64-Debug.pdb
Static task
static1
Behavioral task
behavioral1
Sample
EpicWebHelper.exe
Resource
win7-20240221-en
General
-
Target
EpicWebHelper.exe
-
Size
22.7MB
-
MD5
439a9876b03bdf15f7bd9b79e69fa20b
-
SHA1
ece52e73c20fc3036f7d051a6794e5dca5db853a
-
SHA256
a7cfe2c7337728b4ffa3a5987d3338e5d78c92079b4015b7f4774ead1787f5e3
-
SHA512
fe4447190196bf210292bd501a760ee88634b6bcf5d3027842179cfdb8feffa76b1df752a841a8917552b62f5aa95eb9dd72a632d229212b88e3f698781b42a3
-
SSDEEP
98304:ySF8H5+SeLZNZ6Tv2xTAZ61vLnMqvz+WIz7i:YcSuNZy2xkZUM4y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EpicWebHelper.exe
Files
-
EpicWebHelper.exe.exe windows:6 windows x64 arch:x64
6898cbafe8f84ec892bde0a426e6d110
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
xinput1_3
ord2
ord3
winmm
timeBeginPeriod
kernel32
SetLastError
GetOverlappedResult
SetEvent
ResetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexW
CreateEventW
GetCurrentProcess
GetCurrentProcessId
ExitProcess
CreateThread
GetCurrentThread
OpenThread
SetThreadPriority
SuspendThread
ResumeThread
GetProcessId
GetThreadContext
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetDllDirectoryW
GetDllDirectoryW
ReOpenFile
MoveFileW
FileTimeToSystemTime
SystemTimeToFileTime
K32EnumProcessModulesEx
K32GetModuleFileNameExW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
ConnectNamedPipe
RtlCaptureStackBackTrace
VerSetConditionMask
GetEnvironmentVariableW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDiskFreeSpaceExW
GetFullPathNameW
GetLongPathNameW
GetTempPathW
IsDebuggerPresent
DebugBreak
OutputDebugStringW
SetThreadErrorMode
DisconnectNamedPipe
PeekNamedPipe
CreateNamedPipeW
QueryPerformanceFrequency
ReleaseSemaphore
OpenSemaphoreW
Sleep
CreateSemaphoreW
GetProcessTimes
TerminateProcess
GetExitCodeProcess
SwitchToThread
CreateProcessW
SetPriorityClass
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
FlushInstructionCache
OpenProcess
GetCurrentProcessorNumber
GetThreadIdealProcessorEx
GlobalMemoryStatusEx
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetLocalTime
GetVersionExW
GetLogicalProcessorInformationEx
GetNativeSystemInfo
VirtualProtect
SetUnhandledExceptionFilter
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
LoadResource
LockResource
SizeofResource
FindResourceW
GetNumaNodeProcessorMaskEx
SetThreadGroupAffinity
QueryProcessCycleTime
QueryIdleProcessorCycleTime
SetThreadAffinityMask
FormatMessageW
QueryFullProcessImageNameW
GetComputerNameW
VerifyVersionInfoW
GetSystemPowerStatus
GetNumaProcessorNodeEx
GetUserPreferredUILanguages
GetUserDefaultLocaleName
SetConsoleCtrlHandler
GetConsoleWindow
K32GetProcessMemoryInfo
Process32FirstW
Process32NextW
SetWaitableTimer
CreateWaitableTimerW
GetProcessHandleCount
GetVersion
GlobalAlloc
GlobalUnlock
GlobalLock
GetLocaleInfoW
GetSystemDefaultLCID
AllocConsole
FreeConsole
AttachConsole
GetConsoleScreenBufferInfo
SetConsoleScreenBufferSize
SetConsoleTextAttribute
SetConsoleWindowInfo
FormatMessageA
SetErrorMode
GetModuleHandleExA
GetEnvironmentVariableA
lstrcmpA
LoadLibraryA
GetFullPathNameA
FlsAlloc
FlsSetValue
GetLargePageMinimum
VirtualUnlock
GetACP
GetLocaleInfoEx
GetDynamicTimeZoneInformation
GetGeoInfoW
GetUserGeoID
LCIDToLocaleName
LocaleNameToLCID
GetNumberFormatEx
GetCurrencyFormatEx
ResolveLocaleName
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetTimeFormatEx
GetDateFormatEx
VirtualQuery
LoadLibraryExA
MultiByteToWideChar
InitializeSListHead
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RaiseException
CloseHandle
WriteFile
SetFileTime
SetFilePointer
SetFileAttributesW
SetEndOfFile
RemoveDirectoryW
ReadFile
GetFinalPathNameByHandleW
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
GetLastError
FindNextFileW
DeleteFileW
CreateFileW
CreateDirectoryW
GetCommandLineW
LoadLibraryW
GetProcAddress
CreatePipe
SetHandleInformation
VirtualFree
VirtualAlloc
HeapSetInformation
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
TlsFree
TlsSetValue
FlushFileBuffers
TlsGetValue
WriteConsoleW
GetProcessHeap
GetFileType
FindFirstFileW
FindClose
GetStdHandle
TlsAlloc
GetCurrentThreadId
QueryPerformanceCounter
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetCriticalSectionSpinCount
InitializeCriticalSection
WideCharToMultiByte
GetStartupInfoW
HeapAlloc
HeapFree
OpenFileMappingW
user32
DefWindowProcW
PostMessageW
SendMessageW
GetMessageExtraInfo
DispatchMessageW
TranslateMessage
DisableProcessWindowsGhosting
FlashWindowEx
GetWindowPlacement
SetWindowPlacement
IsIconic
IsZoomed
OpenClipboard
AllowSetForegroundWindow
CloseClipboard
RegisterHotKey
UnregisterHotKey
PostQuitMessage
SetWindowPos
IsWindowVisible
DialogBoxParamW
SetClipboardData
GetClipboardData
RegisterClassW
EmptyClipboard
SetFocus
GetActiveWindow
GetFocus
GetKeyState
UnregisterClassW
SendInput
GetTouchInputInfo
CloseTouchInputHandle
RegisterTouchWindow
GetKeyboardLayout
EnumDisplayDevicesW
MapVirtualKeyW
GetCapture
SetCapture
ReleaseCapture
EnableWindow
IsWindowEnabled
EnableMenuItem
GetSystemMenu
GetRawInputDeviceList
RegisterRawInputDevices
GetRawInputDeviceInfoA
GetWindow
GetWindowThreadProcessId
GetTopWindow
EnumWindows
ScreenToClient
MessageBoxW
GetWindowRect
SetWindowTextW
SetForegroundWindow
GetSystemMetrics
SetDlgItemTextW
GetDlgItem
EndDialog
CreateWindowExW
IsWindow
DestroyWindow
ShowWindow
GetAsyncKeyState
SetLayeredWindowAttributes
GetRawInputData
GetWindowInfo
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromWindow
MonitorFromRect
MonitorFromPoint
SystemParametersInfoW
EnumDisplaySettingsW
CreateIconIndirect
LoadImageW
LoadIconW
LoadCursorFromFileW
LoadCursorW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
FindWindowW
GetClassLongPtrW
SetWindowLongW
GetWindowLongW
ClipCursor
WindowFromPoint
ClientToScreen
GetClipCursor
GetCursorPos
SetCursor
SetCursorPos
ShowCursor
AdjustWindowRectEx
GetClientRect
GetWindowTextW
InvalidateRect
SetWindowRgn
EndPaint
BeginPaint
ReleaseDC
GetDC
GetForegroundWindow
SetActiveWindow
UpdateWindow
DrawStateW
PeekMessageW
gdi32
TextOutW
GetObjectW
SetTextAlign
SetTextColor
SetBkMode
SetBkColor
SelectObject
PtInRegion
GetStockObject
GetPixel
GetDeviceCaps
DeleteObject
CreateRoundRectRgn
CreateRectRgn
CreateFontIndirectW
CreateBitmap
GetTextExtentPoint32W
DeleteDC
CreateDIBSection
CreateCompatibleDC
advapi32
DeregisterEventSource
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegGetValueW
RegDeleteTreeW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
GetUserNameW
ReportEventW
RegisterEventSourceW
shell32
SHGetFolderPathW
ShellExecuteExW
SHGetKnownFolderPath
ShellExecuteW
CommandLineToArgvW
ole32
CoInitialize
CoTaskMemFree
CoCreateGuid
StringFromGUID2
CoCreateInstance
CoUninitialize
OleUninitialize
OleInitialize
ReleaseStgMedium
RevokeDragDrop
RegisterDragDrop
oleaut32
VariantCopy
SysFreeString
SysAllocString
SafeArrayCreateVector
SafeArrayPutElement
netapi32
NetShareGetInfo
NetApiBufferFree
iphlpapi
GetAdaptersInfo
setupapi
SetupDiOpenDevRegKey
CM_Get_Device_IDW
SetupDiGetClassDevsExW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
dwmapi
DwmGetCompositionTimingInfo
DwmIsCompositionEnabled
DwmExtendFrameIntoClientArea
DwmSetWindowAttribute
imm32
ImmGetDescriptionW
ImmGetIMEFileNameW
ImmGetProperty
ImmCreateContext
ImmDestroyContext
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmNotifyIME
ImmSetCompositionWindow
ImmSetCandidateWindow
uiautomationcore
UiaRaiseAutomationEvent
UiaRaiseAutomationPropertyChangedEvent
UiaClientsAreListening
UiaReturnRawElementProvider
UiaHostProviderFromHwnd
msvcp140
_Cnd_wait
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Mtx_unlock
_Mtx_lock
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?get_new_handler@std@@YAP6AXXZXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
?_BADOFF@std@@3_JB
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?_Xlength_error@std@@YAXPEBD@Z
_Cnd_signal
?_Throw_C_error@std@@YAXH@Z
_Cnd_broadcast
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
shlwapi
PathFileExistsW
PathRenameExtensionW
PathFindFileNameW
powrprof
CallNtPowerInformation
vcruntime140
__std_type_info_destroy_list
__current_exception_context
__current_exception
__RTDynamicCast
__std_type_info_name
__std_type_info_compare
__RTtypeid
strchr
memchr
_CxxThrowException
__vcrt_LoadLibraryExW
__vcrt_GetModuleFileNameW
_purecall
memmove
wcsstr
memcmp
strrchr
wcschr
strstr
wcsrchr
__C_specific_handler
_set_purecall_handler
__CxxFrameHandler3
memcpy
__std_terminate
memset
__std_exception_copy
__std_exception_destroy
__C_specific_handler_noexcept
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-math-l1-1-0
trunc
_dtest
_isnan
_dsign
floor
round
_finite
modf
acos
ceil
log
asin
atan
atan2
ldexp
logbf
floorf
powf
modff
acosf
asinf
ceilf
cosf
sinf
pow
cos
fmod
sin
sqrt
tan
__setusermatherr
sqrtf
truncf
fmodf
atan2f
_fdclass
logf
_dclass
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_invoke_watson
_register_thread_local_exe_atexit_callback
_c_exit
_configure_narrow_argv
abort
_initialize_narrow_environment
_errno
_exit
_initialize_onexit_table
_initterm_e
exit
_initterm
_get_narrow_winmain_command_line
_register_onexit_function
_set_app_type
_seh_filter_exe
strerror
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
terminate
_seh_filter_dll
api-ms-win-crt-utility-l1-1-0
div
qsort
rand
srand
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
fputs
_set_fmode
__stdio_common_vsprintf
__acrt_iob_func
fgets
_setmode
__p__commode
_fileno
__stdio_common_vsprintf_s
__stdio_common_vswprintf
__stdio_common_vfwprintf
fflush
api-ms-win-crt-string-l1-1-0
iswspace
wcsncpy
wcsncmp
iswupper
isdigit
strncmp
strcat_s
strncpy
iswalnum
iswalpha
iswxdigit
iswdigit
_wcsupr
strncat
_strupr
_wcsdup
strncpy_s
_strdup
wcsnlen
strspn
strnlen
strcmp
iswlower
towupper
towlower
toupper
isspace
tolower
strcpy_s
api-ms-win-crt-heap-l1-1-0
_set_new_mode
malloc
_get_heap_handle
free
calloc
_heapchk
realloc
api-ms-win-crt-convert-l1-1-0
wcstod
_wtoi64
_wcstoui64
atoi
strtod
strtol
_wtoi
_strtoi64
strtoul
_wcstoi64
atol
wcstoul
_wtof
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
setlocale
api-ms-win-crt-environment-l1-1-0
_wgetenv
getenv
api-ms-win-crt-conio-l1-1-0
_cputs
api-ms-win-crt-time-l1-1-0
_tzset
__tzname
__timezone
Sections
.text Size: 16.1MB - Virtual size: 16.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.uedbg Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 78KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 622KB - Virtual size: 621KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 149KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ