ShaderCompileWorker-SSL.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ec141ab748cc2e27dd34fd9f904333b5bf7705051ee0390410f257b320b59942.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ec141ab748cc2e27dd34fd9f904333b5bf7705051ee0390410f257b320b59942.dll
Resource
win10v2004-20240508-en
General
-
Target
ec141ab748cc2e27dd34fd9f904333b5bf7705051ee0390410f257b320b59942
-
Size
2.7MB
-
MD5
4ea2842fb1726cbcf562b5593eaecd6b
-
SHA1
788c292a9bb8b338683ae76ae6bc3a096a940f36
-
SHA256
ec141ab748cc2e27dd34fd9f904333b5bf7705051ee0390410f257b320b59942
-
SHA512
2ae0b9aa0669fc3216d332d0ae0cdc9e8cf447227c51fee9790a570085113c418eab9d99288b1c8c047217ac9a6e8467ab11ed019c65870e079791816b4a855f
-
SSDEEP
49152:3GtlqcEVwASOf4IU6iopkuShQzaOvlrrM+Dj+oMJLGVnl2bD2EKvRcsNtfHCizr2:PH+stUTHyliCbz/2kBw/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ec141ab748cc2e27dd34fd9f904333b5bf7705051ee0390410f257b320b59942
Files
-
ec141ab748cc2e27dd34fd9f904333b5bf7705051ee0390410f257b320b59942.dll windows:6 windows x64 arch:x64
b908b6027be0027326cc6351f90c3b21
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
shadercompileworker-core
?GCoreComplexObjectPathDebug@@3PEAUFStoredObjectPathDebug@Private@CoreUObject@UE@@EA
?GCoreObjectHandlePackageDebug@@3PEAUFObjectHandlePackageDebugData@Private@CoreUObject@UE@@EA
?Stricmp@FGenericPlatformStricmp@@SAHPEB_W0@Z
?IsEnsureAllowed@FGenericPlatformMisc@@SA_NXZ
?CheckVerifyFailedImpl2@FDebug@@SA_NPEBD0HPEB_WZZ
?EnsureFailed@Private@Assert@UE@@YA_NAEAU?$atomic@_N@std@@PEBUFStaticEnsureRecord@123@ZZ
?Malloc@FMemory@@SAPEAX_KI@Z
?Realloc@FMemory@@SAPEAXPEAX_KI@Z
?Free@FMemory@@SAXPEAX@Z
?QuantizeSize@FMemory@@SA_K_KI@Z
?OnInvalidArrayNum@Private@Core@UE@@YAX_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_KI@Z
??0FString@@QEAA@PEB_W@Z
?AssignRange@FString@@AEAAXPEB_WH@Z
?RemoveAt@FString@@QEAAXHHW4EAllowShrinking@@@Z
?ConcatFF@FString@@CA?AV1@$$QEAV1@AEBV1@@Z
?ConcatFC@FString@@CA?AV1@$$QEAV1@PEB_W@Z
?Find@FString@@QEBAHPEB_WHW4Type@ESearchCase@@W42ESearchDir@@H@Z
?PrintfImpl@FString@@CA?AV1@PEB_WZZ
?EndsWith@FString@@QEBA_NPEB_WHW4Type@ESearchCase@@@Z
?ParseIntoArray@FString@@QEBAHAEAV?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@PEB_W_N@Z
?GEngineIni@@3VFString@@A
?GConfig@@3PEAVFConfigCacheIni@@EA
??$Decode@_W@FBase64@@SA_NPEB_WIPEAEW4EBase64Mode@@@Z
?GetDecodedDataSize@FBase64@@SAIAEBVFString@@@Z
?Encode@FBase64@@SA?AVFString@@PEBEIW4EBase64Mode@@@Z
?LoadModuleChecked@FModuleManager@@QEAAAEAVIModuleInterface@@VFName@@@Z
?Get@FModuleManager@@SAAEAV1@XZ
?GetArray@FConfigCacheIni@@QEAAHPEB_W0AEAV?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@AEBVFString@@@Z
?GetBool@FConfigCacheIni@@QEAA_NPEB_W0AEA_NAEBVFString@@@Z
?GetString@FConfigCacheIni@@QEAA_NPEB_W0AEAVFString@@AEBV2@@Z
?FileExists@FPaths@@SA_NAEBVFString@@@Z
?ProjectContentDir@FPaths@@SA?AVFString@@XZ
?GCoreObjectArrayForDebugVisualizers@@3PEAVFChunkedFixedUObjectArray@@EA
??0FName@@QEAA@PEB_WW4EFindName@@@Z
??0FName@@QEAA@PEBDW4EFindName@@@Z
?GetBlocks@FNameDebugVisualizer@@SAPEAPEAEXZ
??0FLogCategoryBase@@QEAA@AEBVFName@@W4Type@ELogVerbosity@@1@Z
?EngineContentDir@FPaths@@SA?AVFString@@XZ
?Get@IFileManager@@SAAEAV1@XZ
?Get@FCommandLine@@SAPEB_WXZ
?Param@FParse@@SA_NPEB_W0@Z
?GetReadersTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@UFReaderNum@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?GetDestructionSentinelStackTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@PEAUFDestructionSentinel@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?ThreadStackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHI@Z
?StackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHPEAX@Z
?IsInGameThread@@YA_NXZ
??1FScopedBootTiming@@QEAA@XZ
??0FScopedBootTiming@@QEAA@PEBD@Z
?BasicLog@Private@Logging@UE@@YAXAEBUFLogCategoryBase@@PEBUFStaticBasicLogRecord@123@ZZ
??1FLogCategoryBase@@QEAA@XZ
??4FString@@QEAAAEAV0@PEB_W@Z
ws2_32
send
WSASetLastError
socket
WSAGetLastError
ntohs
getaddrinfo
freeaddrinfo
recv
closesocket
setsockopt
listen
connect
getsockname
bind
getnameinfo
accept
WSACleanup
WSAStartup
gethostbyname
getsockopt
ioctlsocket
kernel32
AcquireSRWLockExclusive
WakeAllConditionVariable
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
DisableThreadLibraryCalls
InitializeSListHead
SleepConditionVariableSRW
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
LoadLibraryW
LoadLibraryA
FreeLibrary
CloseHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
ConvertThreadToFiber
ConvertFiberToThread
GetProcAddress
GetModuleHandleW
WriteFile
GetFileType
GetEnvironmentVariableW
GetStdHandle
RtlVirtualUnwind
FormatMessageW
WideCharToMultiByte
MultiByteToWideChar
FindNextFileW
FindFirstFileW
FindClose
CreateFiber
DeleteFiber
SwitchToFiber
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
SetLastError
GetLastError
GetSystemTime
SystemTimeToFileTime
EnterCriticalSection
LeaveCriticalSection
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
advapi32
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
DeregisterEventSource
crypt32
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore
CertOpenSystemStoreW
CertGetNameStringW
CertEnumCertificatesInStore
CertCloseStore
bcrypt
BCryptGenRandom
vcruntime140
wcsstr
__C_specific_handler
__current_exception
__current_exception_context
__std_type_info_destroy_list
strrchr
memchr
strchr
memset
_purecall
strstr
memcmp
memcpy
memmove
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-stdio-l1-1-0
fflush
fgets
__stdio_common_vfprintf
__acrt_iob_func
fopen
_wfopen
fclose
_fileno
__stdio_common_vswprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
_setmode
fwrite
ftell
ferror
feof
fputs
fseek
fread
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
api-ms-win-crt-string-l1-1-0
strspn
strcmp
strncmp
_strnicmp
strcspn
_stricmp
_strdup
strncpy
isspace
api-ms-win-crt-runtime-l1-1-0
signal
strerror_s
terminate
_initterm_e
_initterm
_cexit
_exit
_crt_at_quick_exit
raise
_errno
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_execute_onexit_table
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoul
strtol
atoi
api-ms-win-crt-heap-l1-1-0
realloc
malloc
free
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-environment-l1-1-0
getenv
Exports
Exports
??0FSslManager@@IEAA@XZ
?CreateSslContext@FSslManager@@UEAAPEAUssl_ctx_st@@AEBUFSslContextCreateOptions@@@Z
?DestroySslContext@FSslManager@@UEAAXPEAUssl_ctx_st@@@Z
?Get@FSslModule@@SAAEAV1@XZ
?InitializeSsl@FSslManager@@UEAA_NXZ
?LogSsl@@3UFLogCategoryLogSsl@@A
?ShutdownSsl@FSslManager@@UEAAXXZ
?VerifySslCertificates@FSslCertificateDelegates@@2V?$TDelegate@$$A6A_NAEBVFString@@AEBV?$TArray@UFCertInfo@FSslCertificateDelegates@@V?$TSizedDefaultAllocator@$0CA@@@@@@ZUFDefaultDelegateUserPolicy@@@@A
InitializeModule
Sections
.text Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.uedbg Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 649KB - Virtual size: 648KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ