qsqlpsql[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

qsqlpsql.dll
Size

177KB
MD5

9e92a067bc63159b5776e444b4e167ff
SHA1

cc79120830f6aa7c82b5395039255510b9404a15
SHA256

ced7a6ebf1539f9d3c1d42f91bdd9c288baf1c4822b14c7554619767e01fe657
SHA512

1e9627c46b28c8804710d2283a77b54bc6004f531981aba4659c7824d2352928ac4e2ed135fcdbf95f5061330f9bf0aa2a415dcc69776055986e4a98880e358f
SSDEEP

3072:KcHNS+0i9YhERoO9PWmkbdyKghm7GbuptN5KwqiTMyktBuUJwb:l8+0zOBWZby2GbuptN5KwqiAyktBuUJ0

Score

N/A

Malware Config

Signatures

Files

qsqlpsql.dll
.dll windows x64

c19f51f3b38b8d9512ab04a44c11dbdf

Code Sign

07:e2:ef:84:3d:0d:6f:58:cb:bb:06:e3:e8:b3:d3:20
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

06/10/2020, 00:00

Not After

31/12/2023, 12:00

Subject

CN=The Qt Company Oy,O=The Qt Company Oy,L=Oulu,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:f1:17:6c:08:1b:c1:06:27:41:66:8f:ec:cd:28:93:a5:5e:ac:94:d4:bf:d3:94:56:82:ae:5b:2a:29:6b:9f
Signer

Actual PE Digest

11:f1:17:6c:08:1b:c1:06:27:41:66:8f:ec:cd:28:93:a5:5e:ac:94:d4:bf:d3:94:56:82:ae:5b:2a:29:6b:9f

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=The Qt Company Oy,O=The Qt Company Oy,L=Oulu,C=FI

06/11/2020, 09:09
Valid: true

Chain 1

CN=The Qt Company Oy,O=The Qt Company Oy,L=Oulu,C=FI

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
atoi
calloc
free
fwrite
memmove
realloc
signal
strcmp
strlen
strncmp
vfprintf

libstdc++-6

_ZSt17__throw_bad_allocv
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZdlPv
_ZdlPvy
_Znwy
__cxa_guard_acquire
__cxa_guard_release

qt5core

_Z4qInfv
_Z5qQNaNv
_Z6qIsInfd
_Z6qIsInff
_Z6qIsNaNd
_Z6qIsNaNf
_Z7qstrcmpPKcS0_
_Z7qstrtodPKcPS0_Pb
_Z8qstricmpPKcS0_
_ZN10QArrayData10deallocateEPS_yy
_ZN10QArrayData11shared_nullE
_ZN10QByteArray11fromRawDataEPKci
_ZN10QByteArrayC1EPKci
_ZN11QMetaObject10ConnectionD1Ev
_ZN11QMetaObject12invokeMethodEP7QObjectPKcN2Qt14ConnectionTypeE22QGenericReturnArgument16QGenericArgumentS7_S7_S7_S7_S7_S7_S7_S7_S7_
_ZN11QMetaObject14normalizedTypeEPKc
_ZN14QObjectPrivateC2Ei
_ZN14QObjectPrivateD2Ev
_ZN15QSocketNotifierC1ExNS_4TypeEP7QObject
_ZN15QtSharedPointer20ExternalRefCountData9getAndRefEPK7QObject
_ZN16QCoreApplication9translateEPKcS1_S1_i
_ZN18QRegularExpressionC1ERK7QString6QFlagsINS_13PatternOptionEE
_ZN18QRegularExpressionD1Ev
_ZN23QRegularExpressionMatchD1Ev
_ZN5QDate10fromStringERK7QStringN2Qt10DateFormatE
_ZN5QTime10fromStringERK7QStringN2Qt10DateFormatE
_ZN7QLocaleC1ENS_8LanguageENS_7CountryE
_ZN7QLocaleD1Ev
_ZN7QObject10childEventEP11QChildEvent
_ZN7QObject10disconnectEPKS_PKcS1_S3_
_ZN7QObject10timerEventEP11QTimerEvent
_ZN7QObject11customEventEP6QEvent
_ZN7QObject11eventFilterEPS_P6QEvent
_ZN7QObject13connectNotifyERK11QMetaMethod
_ZN7QObject16disconnectNotifyERK11QMetaMethod
_ZN7QObject5eventEP6QEvent
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE
_ZN7QString11reallocDataEjb
_ZN7QString13toUtf8_helperERKS_
_ZN7QString15fromUtf8_helperEPKci
_ZN7QString17fromLatin1_helperEPKci
_ZN7QString18toLocal8Bit_helperEPK5QChari
_ZN7QString20fromLocal8Bit_helperEPKci
_ZN7QString6appendE13QLatin1String
_ZN7QString6appendE5QChar
_ZN7QString6appendERKS_
_ZN7QString6insertEi5QChar
_ZN7QString6insertEiPK5QChari
_ZN7QString6numberEii
_ZN7QString7replaceE5QChar13QLatin1StringN2Qt15CaseSensitivityE
_ZN7QString7replaceE5QCharS0_N2Qt15CaseSensitivityE
_ZN7QStringC1E5QChar
_ZN7QStringaSERKS_
_ZN8QVariantC1ENS_4TypeE
_ZN8QVariantC1ERK10QByteArray
_ZN8QVariantC1ERK5QDate
_ZN8QVariantC1ERK5QTime
_ZN8QVariantC1ERK7QString
_ZN8QVariantC1ERK9QDateTime
_ZN8QVariantC1ERKS_
_ZN8QVariantC1Eb
_ZN8QVariantC1Ed
_ZN8QVariantC1Ei
_ZN8QVariantC1EiPKvj
_ZN8QVariantC1Ej
_ZN8QVariantC1Ex
_ZN8QVariantC1Ey
_ZN8QVariantD1Ev
_ZN9QDateTime10fromStringERK7QStringN2Qt10DateFormatE
_ZN9QDateTimeD1Ev
_ZN9QHashData11free_helperEPFvPNS_4NodeEE
_ZN9QHashData11shared_nullE
_ZN9QHashData12allocateNodeEi
_ZN9QHashData13detach_helperEPFvPNS_4NodeEPvEPFvS1_Eii
_ZN9QHashData6rehashEi
_ZN9QListData11detach_growEPii
_ZN9QListData11shared_nullE
_ZN9QListData5eraseEPPv
_ZN9QListData6appendEv
_ZN9QListData6detachEi
_ZN9QListData7disposeEPNS_4DataE
_ZN9QMetaType22registerNormalizedTypeERK10QByteArrayPFvPvEPFS3_S3_PKvEi6QFlagsINS_8TypeFlagEEPK11QMetaObject
_ZN9QtPrivate12argToQStringE11QStringViewyPPKNS_7ArgBaseE
_ZN9QtPrivate20QStringList_containsEPK11QStringListRK7QStringN2Qt15CaseSensitivityE
_ZNK10QByteArray10toLongLongEPbi
_ZNK10QByteArray11toULongLongEPbi
_ZNK10QByteArray5toIntEPbi
_ZNK10QStringRef5toIntEPbi
_ZNK11QMetaObject2trEPKcS1_i
_ZNK11QObjectData17dynamicMetaObjectEv
_ZNK14QMessageLogger7warningEPKcz
_ZNK18QRegularExpression5matchERK7QStringiNS_9MatchTypeE6QFlagsINS_11MatchOptionEE
_ZNK23QRegularExpressionMatch11capturedRefEi
_ZNK23QRegularExpressionMatch8hasMatchEv
_ZNK5QTime7isValidEv
_ZNK5QTime8toStringE11QStringView
_ZNK7QLocale8toStringERK9QDateTime11QStringView
_ZNK7QString10startsWithE5QCharN2Qt15CaseSensitivityE
_ZNK7QString11lastIndexOfE5QChariN2Qt15CaseSensitivityE
_ZNK7QString3argERKS_i5QChar
_ZNK7QString3argExii5QChar
_ZNK7QString3midEii
_ZNK7QString4leftEi
_ZNK7QString7indexOfE5QChariN2Qt15CaseSensitivityE
_ZNK7QString8endsWithE5QCharN2Qt15CaseSensitivityE
_ZNK7QStringeqE13QLatin1String
_ZNK8QVariant10toDateTimeEv
_ZNK8QVariant11toByteArrayEv
_ZNK8QVariant4typeEv
_ZNK8QVariant5toIntEPb
_ZNK8QVariant6isNullEv
_ZNK8QVariant6toBoolEv
_ZNK8QVariant6toTimeEv
_ZNK8QVariant7toFloatEPb
_ZNK8QVariant8toDoubleEPb
_ZNK8QVariant8toStringEv
_ZNK9QDateTime10toTimeSpecEN2Qt8TimeSpecE
_ZNK9QDateTime7isValidEv
_ZeqRK7QStringS1_

qt5sql

_ZN10QSqlDriver11cancelQueryEv
_ZN10QSqlDriver11qt_metacallEN11QMetaObject4CallEiPPv
_ZN10QSqlDriver11qt_metacastEPKc
_ZN10QSqlDriver12notificationERK7QString
_ZN10QSqlDriver12notificationERK7QStringNS_18NotificationSourceERK8QVariant
_ZN10QSqlDriver12setLastErrorERK9QSqlError
_ZN10QSqlDriver12setOpenErrorEb
_ZN10QSqlDriver16staticMetaObjectE
_ZN10QSqlDriver7setOpenEb
_ZN10QSqlDriverC2ER17QSqlDriverPrivateP7QObject
_ZN10QSqlDriverD2Ev
_ZN10QSqlRecord6appendERK9QSqlField
_ZN10QSqlRecordC1Ev
_ZN10QSqlResult11savePrepareERK7QString
_ZN10QSqlResult12setLastErrorERK9QSqlError
_ZN10QSqlResult12virtual_hookEiPv
_ZN10QSqlResult13fetchPreviousEv
_ZN10QSqlResult14setForwardOnlyEb
_ZN10QSqlResult19detachFromResultSetEv
_ZN10QSqlResult27setNumericalPrecisionPolicyEN4QSql24NumericalPrecisionPolicyE
_ZN10QSqlResult4execEv
_ZN10QSqlResult5setAtEi
_ZN10QSqlResult7prepareERK7QString
_ZN10QSqlResult8setQueryERK7QString
_ZN10QSqlResult9bindValueERK7QStringRK8QVariant6QFlagsIN4QSql13ParamTypeFlagEE
_ZN10QSqlResult9bindValueEiRK8QVariant6QFlagsIN4QSql13ParamTypeFlagEE
_ZN10QSqlResult9execBatchEb
_ZN10QSqlResult9setActiveEb
_ZN10QSqlResult9setSelectEb
_ZN10QSqlResultC2ER17QSqlResultPrivate
_ZN10QSqlResultD2Ev
_ZN16QSqlDriverPlugin11qt_metacallEN11QMetaObject4CallEiPPv
_ZN16QSqlDriverPlugin11qt_metacastEPKc
_ZN16QSqlDriverPlugin16staticMetaObjectE
_ZN16QSqlDriverPluginC2EP7QObject
_ZN16QSqlDriverPluginD2Ev
_ZN9QSqlErrorC1ERK7QStringS2_NS_9ErrorTypeES2_
_ZN9QSqlErrorD1Ev
_ZN9QSqlField10setSqlTypeEi
_ZN9QSqlField12setPrecisionEi
_ZN9QSqlField12setTableNameERK7QString
_ZN9QSqlField15setDefaultValueERK8QVariant
_ZN9QSqlField17setRequiredStatusENS_14RequiredStatusE
_ZN9QSqlField5clearEv
_ZN9QSqlField7setNameERK7QString
_ZN9QSqlField7setTypeEN8QVariant4TypeE
_ZN9QSqlField8setValueERK8QVariant
_ZN9QSqlField9setLengthEi
_ZN9QSqlFieldC1ERK7QStringN8QVariant4TypeE
_ZN9QSqlFieldC1ERK7QStringN8QVariant4TypeES2_
_ZN9QSqlFieldD1Ev
_ZN9QSqlIndex6appendERK9QSqlField
_ZN9QSqlIndex7setNameERK7QString
_ZN9QSqlIndexC1ERK7QStringS2_
_ZN9QSqlQuery14setForwardOnlyEb
_ZN9QSqlQuery4execERK7QString
_ZN9QSqlQuery4nextEv
_ZN9QSqlQueryC1EP10QSqlResult
_ZN9QSqlQueryD1Ev
_ZNK10QSqlDriver11formatValueERK9QSqlFieldb
_ZNK10QSqlDriver11isOpenErrorEv
_ZNK10QSqlDriver12sqlStatementENS_13StatementTypeERK7QStringRK10QSqlRecordb
_ZNK10QSqlDriver15stripDelimitersERK7QStringNS_14IdentifierTypeE
_ZNK10QSqlDriver19isIdentifierEscapedERK7QStringNS_14IdentifierTypeE
_ZNK10QSqlResult11boundValuesEv
_ZNK10QSqlResult13isForwardOnlyEv
_ZNK10QSqlResult24numericalPrecisionPolicyEv
_ZNK10QSqlResult2atEv
_ZNK10QSqlResult6driverEv
_ZNK10QSqlResult8isActiveEv
_ZNK10QSqlResult8isSelectEv
_ZNK17QSqlResultPrivate24positionalToNamedBindingERK7QString
_ZNK9QSqlField4typeEv
_ZNK9QSqlField6isNullEv
_ZNK9QSqlQuery5valueEi
_ZNK9QSqlQuery8isActiveEv
_ZTV17QSqlResultPrivate

libpq

ord1
ord4
ord14
ord15
ord16
ord17
ord21
ord22
ord23
ord24
ord26
ord33
ord34
ord35
ord37
ord39
ord40
ord41
ord42
ord44
ord45
ord47
ord48
ord71
ord94
ord95
ord106
ord107
ord127
ord161

Exports

Exports

qt_plugin_instance
qt_plugin_query_metadata

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 117B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/16
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c19f51f3b38b8d9512ab04a44c11dbdf

Code Sign

07:e2:ef:84:3d:0d:6f:58:cb:bb:06:e3:e8:b3:d3:20Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

11:f1:17:6c:08:1b:c1:06:27:41:66:8f:ec:cd:28:93:a5:5e:ac:94:d4:bf:d3:94:56:82:ae:5b:2a:29:6b:9fSigner

Signature Validations

Verification

06/11/2020, 09:09 Valid: true

Chain 1

Headers

File Characteristics

Imports

kernel32

msvcrt

libstdc++-6

qt5core

qt5sql

libpq

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 47KB

.data Size: 512B - Virtual size: 288B

.rdata Size: 10KB - Virtual size: 9KB

/4 Size: 512B - Virtual size: 128B

.pdata Size: 2KB - Virtual size: 2KB

.xdata Size: 2KB - Virtual size: 2KB

.bss Size: - Virtual size: 2KB

.edata Size: 512B - Virtual size: 117B

.idata Size: 14KB - Virtual size: 13KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 832B

.reloc Size: 512B - Virtual size: 384B

/16 Size: 512B - Virtual size: 24B

07:e2:ef:84:3d:0d:6f:58:cb:bb:06:e3:e8:b3:d3:20
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

11:f1:17:6c:08:1b:c1:06:27:41:66:8f:ec:cd:28:93:a5:5e:ac:94:d4:bf:d3:94:56:82:ae:5b:2a:29:6b:9f
Signer

06/11/2020, 09:09
Valid: true

.text
Size: 48KB - Virtual size: 47KB

.data
Size: 512B - Virtual size: 288B

.rdata
Size: 10KB - Virtual size: 9KB

/4
Size: 512B - Virtual size: 128B

.pdata
Size: 2KB - Virtual size: 2KB

.xdata
Size: 2KB - Virtual size: 2KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 117B

.idata
Size: 14KB - Virtual size: 13KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 832B

.reloc
Size: 512B - Virtual size: 384B

/16
Size: 512B - Virtual size: 24B