C:\Qt\5.15.8\Src\qtwebengine\build\bin\QtWebEngineProcess.pdb
Static task
static1
Behavioral task
behavioral1
Sample
938b3b489d27bedd8c999abb8d04bba0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
938b3b489d27bedd8c999abb8d04bba0N.exe
Resource
win10v2004-20240802-en
General
-
Target
938b3b489d27bedd8c999abb8d04bba0N.exe
-
Size
1.1MB
-
MD5
938b3b489d27bedd8c999abb8d04bba0
-
SHA1
49e326db4f2a3e01a0b31762e9196e51283ddff1
-
SHA256
31384224f1114ae7ab3b2237248abbb335fd1257e8552ca28defa80935e30c8d
-
SHA512
36e6d5122c2bbcc2ece9246242b41c18a56083524d3012c6c6da37cb71dd342d48c1093461d4e4fd38a84b80a8904df97478e031fbc15a3f37e0666045b96c76
-
SSDEEP
24576:qqd8LjywEhb4q1ppZY87NnmkUv+KzF+yH3:v2ffES2p1SvN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 938b3b489d27bedd8c999abb8d04bba0N.exe
Files
-
938b3b489d27bedd8c999abb8d04bba0N.exe.exe windows:5 windows x86 arch:x86
7f9fb731bf351e552ed12b6e1b278e91
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
qt5core
?Windows8_1@QOperatingSystemVersion@@2V1@B
?compare@QOperatingSystemVersion@@CAHABV1@0@Z
?current@QOperatingSystemVersion@@SA?AV1@XZ
?setFileName@QLibrary@@QAEXABVQString@@@Z
?load@QLibrary@@QAE_NXZ
?resolve@QLibrary@@QAEP6AXXZPBD@Z
??1QLibrary@@UAE@XZ
??0QLibrary@@QAE@PAVQObject@@@Z
??1QString@@QAE@XZ
?qErrnoWarning@@YAXHPBDZZ
?warning@QMessageLogger@@QBAXPBDZZ
??0QMessageLogger@@QAE@PBDH0@Z
??1QCoreApplication@@UAE@XZ
??0QCoreApplication@@QAE@AAHPAPADH@Z
advapi32
RegQueryValueExW
EventRegister
EventUnregister
EventWrite
GetTokenInformation
SetTokenInformation
SetEntriesInAclW
GetSecurityInfo
SetSecurityInfo
AccessCheck
EqualSid
FreeSid
GetAce
ImpersonateLoggedOnUser
IsValidSid
MapGenericMask
RevertToSelf
GetNamedSecurityInfoW
OpenProcessToken
CreateRestrictedToken
DuplicateToken
DuplicateTokenEx
LookupPrivilegeValueW
GetKernelObjectSecurity
GetLengthSid
GetSecurityDescriptorSacl
SetKernelObjectSecurity
ConvertSidToStringSidW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction036
CopySid
CreateWellKnownSid
GetSidSubAuthority
InitializeSid
CreateProcessAsUserW
SetThreadToken
RegCloseKey
RegDisablePredefinedCache
RegOpenKeyExW
RegCreateKeyExW
user32
CreateDesktopW
CloseWindowStation
CloseDesktop
GetProcessWindowStation
GetUserObjectInformationW
CreateWindowStationW
SetProcessWindowStation
GetThreadDesktop
kernel32
IsDebuggerPresent
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
CloseHandle
GetLastError
GetCurrentProcessId
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetLastError
LocalFree
GetModuleHandleW
GetProcAddress
DuplicateHandle
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
GetCurrentProcess
CreateThread
GetCurrentThreadId
TerminateJobObject
SetInformationJobObject
RegisterWaitForSingleObject
UnregisterWait
SetHandleInformation
GetCurrentThread
GetProcessHandleCount
GetCurrentProcessorNumber
VirtualFree
GetModuleHandleA
SetThreadAffinityMask
GetProcessHeaps
VirtualAllocEx
VirtualProtectEx
WriteProcessMemory
LoadLibraryW
CreateJobObjectW
AssignProcessToJobObject
QueryInformationJobObject
CreateNamedPipeW
DebugBreak
lstrlenW
HeapSetInformation
VirtualQueryEx
SetProcessDEPPolicy
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
WideCharToMultiByte
SearchPathW
GetCurrentDirectoryW
GetThreadId
CreateRemoteThread
CreateProcessW
ProcessIdToSessionId
GetFileType
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SignalObjectAndWait
CreateMutexW
TerminateProcess
FreeLibrary
HeapDestroy
GetTickCount
GetUserDefaultLangID
GetUserDefaultLCID
GetUserDefaultLocaleName
EnumSystemLocalesEx
UnregisterWaitEx
CreateFileW
GetFileAttributesW
GetLongPathNameW
QueryDosDeviceW
ReadProcessMemory
VirtualFreeEx
GetModuleHandleExW
Sleep
AcquireSRWLockExclusive
QueryPerformanceCounter
QueryPerformanceFrequency
GetVersionExW
GetNativeSystemInfo
GetProductInfo
IsWow64Process
WriteFile
OutputDebugStringA
GetLocalTime
GetModuleFileNameW
FormatMessageA
VirtualQuery
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
GetSystemTimeAsFileTime
QueryThreadCycleTime
GetThreadPriority
ExpandEnvironmentStringsW
GetCommandLineW
LoadLibraryExW
TlsGetValue
GetProcessTimes
SetCurrentDirectoryW
SetThreadPriority
K32QueryWorkingSetEx
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
TlsAlloc
TlsSetValue
TlsFree
RaiseException
ole32
CoTaskMemFree
qt5webenginecore
?processMain@QtWebEngineCore@@YAHHPAPBD@Z
?staticSandboxInterfaceInfo@QtWebEngineCore@@YAPAUSandboxInterfaceInfo@sandbox@@PAU23@@Z
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_lock
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA
?_Xlength_error@std@@YAXPBD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
vcruntime140
__current_exception
__CxxFrameHandler3
memset
_purecall
memcpy
__current_exception_context
_except_handler4_common
strstr
__std_exception_destroy
__std_exception_copy
strchr
memchr
memcmp
memmove
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
realloc
_callnewh
api-ms-win-crt-runtime-l1-1-0
_exit
terminate
_controlfp_s
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_invoke_watson
abort
_c_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
strerror
_errno
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-string-l1-1-0
_wcsnicmp
_wcsdup
_wcsicmp
strncpy
isxdigit
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vfprintf
__acrt_iob_func
fwrite
__stdio_common_vsscanf
fflush
_set_fmode
_write
__stdio_common_vswprintf
__stdio_common_vsprintf
__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
api-ms-win-crt-math-l1-1-0
_libm_sse2_log_precise
round
_libm_sse2_exp_precise
ceil
_dclass
__setusermatherr
floor
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
shell32
CommandLineToArgvW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
Exports
Exports
GetHandleVerifier
IsSandboxedProcess
_TargetConfigureOPMProtectedOutput@20
_TargetCreateNamedPipeW@36
_TargetCreateOPMProtectedOutputs@24
_TargetCreateProcessA@44
_TargetCreateProcessW@44
_TargetCreateThread@28
_TargetDestroyOPMProtectedOutput@8
_TargetEnumDisplayDevicesA@20
_TargetEnumDisplayMonitors@20
_TargetGdiDllInitialize@12
_TargetGetCertificate@20
_TargetGetCertificateByHandle@20
_TargetGetCertificateSize@16
_TargetGetCertificateSizeByHandle@16
_TargetGetMonitorInfoA@12
_TargetGetMonitorInfoW@12
_TargetGetOPMInformation@16
_TargetGetOPMRandomNumber@12
_TargetGetStockObject@8
_TargetGetSuggestedOPMProtectedOutputArraySize@12
_TargetNtCreateEvent@24
_TargetNtCreateFile@48
_TargetNtCreateKey@32
_TargetNtCreateSection@32
_TargetNtMapViewOfSection@44
_TargetNtOpenEvent@16
_TargetNtOpenFile@28
_TargetNtOpenKey@16
_TargetNtOpenKeyEx@20
_TargetNtOpenProcess@20
_TargetNtOpenProcessToken@16
_TargetNtOpenProcessTokenEx@20
_TargetNtOpenThread@20
_TargetNtOpenThreadToken@20
_TargetNtOpenThreadTokenEx@24
_TargetNtQueryAttributesFile@12
_TargetNtQueryFullAttributesFile@12
_TargetNtSetInformationFile@24
_TargetNtSetInformationThread@20
_TargetNtUnmapViewOfSection@12
_TargetRegisterClassW@8
_TargetSetOPMSigningKeyAndSequenceNumbers@12
g_handles_to_close
g_interceptions
g_nt
g_originals
g_shared_IPC_size
g_shared_delayed_integrity_level
g_shared_delayed_mitigations
g_shared_policy_size
g_shared_section
Sections
.text Size: 368KB - Virtual size: 368KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 580KB - Virtual size: 584KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE