WebAuthBridge.pdb
Static task
static1
Behavioral task
behavioral1
Sample
WebAuthBridge.exe
Resource
win10v2004-20240802-en
General
-
Target
WebAuthBridge.exe
-
Size
463KB
-
MD5
cd96fc51dec205074a643df087579c97
-
SHA1
31db423415e736fb1457ceae0072165e078bcb62
-
SHA256
cba9eaf04ddfbb6bc46de6d9dc4d17f072ee7c67d6a95c043dfd87321b5665fc
-
SHA512
607e381c05058555758cba8cba30c1debab53902922a7d62d0f3614420e5990a300b0796b89d25bfaeaa216e487fe9b0ec61954505ad97bfa34e406a9b85e854
-
SSDEEP
6144:sKdDYnuw/mJJdVSf6lEc+ZY6tSxJxxhVJwxmPX10xZw918dnr9WqcA3CI:suD7w0rl+Z7IP0i10x+91UJ8A3C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WebAuthBridge.exe
Files
-
WebAuthBridge.exe.exe windows:10 windows x64 arch:x64
852a6b3a9c37ec77bb8d284ee853a670
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntdll
RtlGetDeviceFamilyInfoEnum
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventActivityIdControl
EventRegister
EventUnregister
api-ms-win-core-synch-l1-2-0
InitOnceComplete
Sleep
InitOnceBeginInitialize
InitOnceExecuteOnce
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-synch-l1-1-0
CreateEventW
DeleteCriticalSection
InitializeCriticalSectionEx
WaitForSingleObjectEx
SetEvent
InitializeCriticalSection
ReleaseMutex
LeaveCriticalSection
ResetEvent
CreateSemaphoreExW
CreateEventExW
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
OpenSemaphoreW
EnterCriticalSection
ReleaseSemaphore
CreateMutexExW
ReleaseSRWLockShared
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoGetContextToken
CoCreateFreeThreadedMarshaler
CoGetApartmentType
CoGetObjectContext
CLSIDFromString
CoTaskMemAlloc
api-ms-win-core-handle-l1-1-0
CloseHandle
winhttp
WinHttpCreateUrl
WinHttpSetStatusCallback
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpOpen
WinHttpCrackUrl
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
msvcrt
__setusermatherr
_initterm
_acmdln
_fmode
_commode
_ismbblead
__ExceptionPtrDestroy
_cexit
_exit
memset
_callnewh
malloc
memmove
memcpy
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
exit
__set_app_type
__getmainargs
_amsg_exit
__ExceptionPtrCopy
??0exception@@QEAA@AEBV0@@Z
_XcptFilter
__CxxFrameHandler3
??1type_info@@UEAA@XZ
_onexit
__C_specific_handler
__dllonexit
_lock
wcsrchr
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
wcsstr
_vsnprintf_s
wcstoul
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
?terminate@@YAXXZ
memcpy_s
_vsnwprintf
_purecall
??3@YAXPEAX@Z
__CxxFrameHandler4
_wcsnicmp
__ExceptionPtrCurrentException
__ExceptionPtrCreate
_unlock
wcslen
urlmon
UrlMkSetSessionOption
wincorlib
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
?__abi_FailFast@@YAXXZ
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?UninitializeData@Details@Platform@@YAXH@Z
?InitializeData@Details@Platform@@YAJH@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
??0ChangedStateException@Platform@@QE$AAA@XZ
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
??0FailureException@Platform@@QE$AAA@XZ
??0OutOfMemoryException@Platform@@QE$AAA@XZ
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
??0OutOfBoundsException@Platform@@QE$AAA@XZ
??0NotImplementedException@Platform@@QE$AAA@XZ
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z
?ReCreateException@Exception@Platform@@SAPE$AAV12@H@Z
?GetCmdArguments@Details@Platform@@YAPEAPEA_WPEAH@Z
?__abi_WinRTraiseInvalidCastException@@YAXXZ
??0Delegate@Platform@@QE$AAA@XZ
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
??0FailureException@Platform@@QE$AAA@PE$AAVString@1@@Z
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
??BType@Platform@@SA?AVTypeName@Interop@Xaml@UI@Windows@@PE$AAV01@@Z
?ToString@Enum@Platform@@QE$AAAPE$AAVString@2@XZ
?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ
?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?Free@Heap@Details@Platform@@SAXPEAX@Z
??0Object@Platform@@QE$AAA@XZ
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
??0DisconnectedException@Platform@@QE$AAA@XZ
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
SetRestrictedErrorInfo
RoFailFastWithErrorContext
api-ms-win-core-winrt-error-l1-1-1
RoReportUnhandledError
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsCreateStringReference
WindowsConcatString
WindowsCompareStringOrdinal
WindowsDuplicateString
WindowsGetStringLen
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsDeleteString
Sections
.text Size: 327KB - Virtual size: 327KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ