C:\Users\whatw\Documents\GitHub\InfinityRecovery\Binaries\Release\a1.pdb
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W64.ABRisk.USTO-0275.27330.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W64.ABRisk.USTO-0275.27330.dll
Resource
win10v2004-20231215-en
General
-
Target
SecuriteInfo.com.W64.ABRisk.USTO-0275.27330.4345
-
Size
2.4MB
-
MD5
da8060fb0033706cefff7442cf792478
-
SHA1
503da051a3a592ec992aa9fb128669eda361dd33
-
SHA256
2058da4558edbec83d1ed2ac7b37a318b36ef57856ac7aa755203bf48cd541c8
-
SHA512
3a57e25077e993d30275fb07f9232ff5ddf8d5f0dcd8992da7168efa420761d01abd22d22f5ab5b5ac2e5fdf6fb0dc4cf5ddefd92e1741895eccf78d75dd9215
-
SSDEEP
49152:YzPStX5dUQJ8N/PIWpnx3Tp9DMbJcioxcKK2SewFiYCJc7vfmI:Yz0KHIU9DMbJcioxcKK2SewFiYCJc7vj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.W64.ABRisk.USTO-0275.27330.4345
Files
-
SecuriteInfo.com.W64.ABRisk.USTO-0275.27330.4345.dll windows:6 windows x64 arch:x64
79a222850dd0c8902453e700b6d53f3f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
winmm
timeGetTime
ws2_32
__WSAFDIsSet
ntohl
gethostname
closesocket
sendto
recvfrom
freeaddrinfo
getaddrinfo
recv
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
ioctlsocket
WSAIoctl
WSAStartup
WSACleanup
accept
htonl
listen
select
normaliz
IdnToAscii
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CryptStringToBinaryA
CertOpenStore
PFXImportCertStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertFindCertificateInStore
wldap32
ord217
ord211
ord60
ord30
ord45
ord50
ord41
ord22
ord26
ord27
ord143
ord32
ord33
ord35
ord301
ord46
ord200
ord79
kernel32
GetFileInformationByHandleEx
LocalFree
GetLocaleInfoEx
ReleaseSRWLockExclusive
SetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateDirectoryW
WaitNamedPipeW
WriteFile
CreateToolhelp32Snapshot
Process32First
CloseHandle
lstrcmpiA
Process32Next
GetModuleHandleA
GetProcAddress
Process32FirstW
GetCurrentProcessId
OpenProcess
ReadProcessMemory
Process32NextW
LoadLibraryA
GetTickCount
MultiByteToWideChar
AcquireSRWLockExclusive
WideCharToMultiByte
GlobalUnlock
GlobalAlloc
GlobalFree
QueryPerformanceFrequency
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetTickCount64
AttachConsole
AllocConsole
SetConsoleTitleW
GetConsoleWindow
SetConsoleCP
SetConsoleOutputCP
SetConsoleMode
GetStdHandle
SetConsoleTextAttribute
FreeLibraryAndExitThread
CreateThread
CreateFiber
DeleteFiber
SwitchToFiber
ConvertThreadToFiber
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCurrentProcess
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetModuleHandleW
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
GetLastError
SetLastError
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
CreateFileW
AreFileApisANSI
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
InitializeSListHead
FreeConsole
GetModuleFileNameW
GlobalLock
lstrlenW
user32
EnableMenuItem
GetSystemMenu
SetLayeredWindowAttributes
IsWindowUnicode
ReleaseCapture
SetCapture
FindWindowA
TrackMouseEvent
GetClientRect
ScreenToClient
GetCursorPos
SetCursorPos
ClientToScreen
GetForegroundWindow
GetKeyState
LoadCursorA
SetCursor
SetClipboardData
EmptyClipboard
MessageBoxA
GetClipboardData
OpenClipboard
GetCapture
GetAsyncKeyState
GetWindowRect
CloseClipboard
advapi32
CryptReleaseContext
CryptImportKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
CryptAcquireContextA
CryptEncrypt
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
shell32
ShellExecuteA
SHGetFolderPathW
d3dcompiler_47
D3DCompile
urlmon
URLDownloadToFileA
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
_Thrd_start
_Thrd_join
_Thrd_id
_Mtx_destroy
_Mtx_current_owns
_Cnd_init
_Cnd_destroy
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
_Cnd_timedwait
_Cnd_broadcast
_Cnd_signal
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
_Mtx_init
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_destroy_in_situ
?_Xout_of_range@std@@YAXPEBD@Z
?_Incref@facet@locale@std@@UEAAXXZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
_Xtime_get_ticks
_Mtx_init_in_situ
_Query_perf_counter
_Query_perf_frequency
?_Xbad_function_call@std@@YAXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?always_noconv@codecvt_base@std@@QEBA_NXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
_Mtx_unlock
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?uncaught_exceptions@std@@YAHXZ
?good@ios_base@std@@QEBA_NXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
_Thrd_yield
_Thrd_sleep
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?fail@ios_base@std@@QEBA_NXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
ImmSetCandidateWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
_local_unwind
__current_exception_context
__current_exception
__std_type_info_destroy_list
__CxxFrameHandler3
__std_terminate
__std_exception_copy
__std_exception_destroy
_purecall
__C_specific_handler
strstr
strchr
memcpy
memset
strrchr
memmove
memcmp
memchr
api-ms-win-crt-heap-l1-1-0
_callnewh
calloc
realloc
free
malloc
api-ms-win-crt-runtime-l1-1-0
_cexit
_crt_atexit
_execute_onexit_table
_initterm
_initterm_e
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
abort
terminate
_getpid
_beginthreadex
__sys_nerr
_errno
raise
exit
_invalid_parameter_noinfo_noreturn
strerror
api-ms-win-crt-stdio-l1-1-0
fseek
fgetc
ungetc
feof
ferror
fread
_get_stream_buffer_pointers
_open
_close
_write
_read
fopen_s
__stdio_common_vswprintf
fclose
ftell
fwrite
_lseeki64
__stdio_common_vsprintf
fopen
fgets
__stdio_common_vsprintf_s
fputs
_wfopen
_fseeki64
fgetpos
fsetpos
setvbuf
fputc
__acrt_iob_func
fflush
__stdio_common_vfprintf
__stdio_common_vsscanf
api-ms-win-crt-math-l1-1-0
_dclass
ceil
_fdclass
_fdsign
_dsign
cos
cosf
ceilf
fmodf
pow
powf
_ldsign
sin
ldexp
acosf
sinf
sqrt
sqrtf
_ldclass
log2
api-ms-win-crt-string-l1-1-0
toupper
_strdup
strncpy
isupper
strpbrk
strspn
strncmp
strcspn
tolower
strcmp
api-ms-win-crt-convert-l1-1-0
strtoul
wcstombs
strtod
strtoll
strtol
atoi
strtoull
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
_localtime64
api-ms-win-crt-filesystem-l1-1-0
_unlink
_access
_stat64
_wmkdir
_fstat64
_unlock_file
_lock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 574KB - Virtual size: 573KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 510KB - Virtual size: 727KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ