qsqlodbc[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

qsqlodbc.dll
Size

186KB
MD5

3d0275169371f6278bd8d354de86e4e5
SHA1

cc662746738266147014714faa15c2627384c6a9
SHA256

e64253c79032aff9730c22feaa28f018ad7636f4a5e1ca0999931f797506c6a1
SHA512

96c5d052ffd5a6930be2a7396d26c1dded8fb4f211c138caf3e339ff4f6a6599059fac312ab6170e6c7f02312979481669a7f593a356ddd40142fc867725dffc
SSDEEP

3072:pT278PFY/ihGZF2FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFs:V8CFY/+qF2FFFFFFFFFFFFFFFFFFFFF+

Score

N/A

Malware Config

Signatures

Files

qsqlodbc.dll
.dll windows x64

ccb90ffe781f68bbd91f252203a598d5

Code Sign

07:e2:ef:84:3d:0d:6f:58:cb:bb:06:e3:e8:b3:d3:20
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

06/10/2020, 00:00

Not After

31/12/2023, 12:00

Subject

CN=The Qt Company Oy,O=The Qt Company Oy,L=Oulu,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ee:b9:02:5b:4b:dc:66:91:a1:02:b9:1c:58:fa:b2:2b:f5:cf:d2:83:3d:d5:e8:c6:51:ea:53:e0:ca:98:0e:e9
Signer

Actual PE Digest

ee:b9:02:5b:4b:dc:66:91:a1:02:b9:1c:58:fa:b2:2b:f5:cf:d2:83:3d:d5:e8:c6:51:ea:53:e0:ca:98:0e:e9

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=The Qt Company Oy,O=The Qt Company Oy,L=Oulu,C=FI

06/11/2020, 09:09
Valid: true

Chain 1

CN=The Qt Company Oy,O=The Qt Company Oy,L=Oulu,C=FI

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__iob_func
__setusermatherr
_amsg_exit
_errno
_initterm
_lock
_unlock
abort
calloc
fprintf
free
fwrite
malloc
memcpy
memset
realloc
signal
strcmp
strlen
strncmp
vfprintf

odbc32

SQLAllocHandle
SQLBindParameter
SQLCloseCursor
SQLColAttributeW
SQLColumnsW
SQLDescribeColW
SQLDisconnect
SQLDriverConnectW
SQLEndTran
SQLExecDirectW
SQLExecute
SQLFetch
SQLFetchScroll
SQLFreeHandle
SQLGetData
SQLGetDiagRecW
SQLGetFunctions
SQLGetInfoW
SQLGetStmtAttrW
SQLGetTypeInfoW
SQLMoreResults
SQLNumResultCols
SQLPrepareW
SQLPrimaryKeysW
SQLRowCount
SQLSetConnectAttrW
SQLSetEnvAttr
SQLSetStmtAttrW
SQLSpecialColumnsW
SQLTablesW

libstdc++-6

_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZdlPv
_ZdlPvy
_Znwy
__cxa_guard_acquire
__cxa_guard_release

qt5core

_ZN10QArrayData10deallocateEPS_yy
_ZN10QArrayData11shared_nullE
_ZN10QArrayData8allocateEyyy6QFlagsINS_16AllocationOptionEE
_ZN10QByteArray11reallocDataEj6QFlagsIN10QArrayData16AllocationOptionEE
_ZN10QByteArray6resizeEi
_ZN10QByteArrayC1EPKci
_ZN11QMetaObject14normalizedTypeEPKc
_ZN11QTextStreamlsERK7QString
_ZN11QTextStreamlsEc
_ZN11QTextStreamlsEi
_ZN11QTextStreamlsEs
_ZN11QTextStreamlsEt
_ZN14QObjectPrivateC2Ei
_ZN14QObjectPrivateD2Ev
_ZN15QtSharedPointer20ExternalRefCountData9getAndRefEPK7QObject
_ZN16QCoreApplication9translateEPKcS1_S1_i
_ZN5QDateC1Eiii
_ZN5QTimeC1Eiiii
_ZN6QDebug9putStringEPK5QChary
_ZN6QDebugD1Ev
_ZN7QObject10childEventEP11QChildEvent
_ZN7QObject10timerEventEP11QTimerEvent
_ZN7QObject11customEventEP6QEvent
_ZN7QObject11eventFilterEPS_P6QEvent
_ZN7QObject13connectNotifyERK11QMetaMethod
_ZN7QObject16disconnectNotifyERK11QMetaMethod
_ZN7QObject5eventEP6QEvent
_ZN7QString11reallocDataEjb
_ZN7QString13toUtf8_helperERKS_
_ZN7QString14toLower_helperERKS_
_ZN7QString14toUpper_helperERKS_
_ZN7QString15fromUtf8_helperEPKci
_ZN7QString17fromLatin1_helperEPKci
_ZN7QString17simplified_helperERS_
_ZN7QString6appendE5QChar
_ZN7QString6appendERKS_
_ZN7QString6insertEi5QChar
_ZN7QString6numberEii
_ZN7QString7replaceE5QCharRKS_N2Qt15CaseSensitivityE
_ZN7QString9fromUtf16EPKti
_ZN7QStringC1E5QChar
_ZN7QStringaSE13QLatin1String
_ZN7QStringaSERKS_
_ZN8QVariant6detachEv
_ZN8QVariantC1ENS_4TypeE
_ZN8QVariantC1ERK10QByteArray
_ZN8QVariantC1ERK5QDate
_ZN8QVariantC1ERK5QTime
_ZN8QVariantC1ERK7QString
_ZN8QVariantC1ERK9QDateTime
_ZN8QVariantC1ERKS_
_ZN8QVariantC1Ed
_ZN8QVariantC1Ei
_ZN8QVariantC1EiPKv
_ZN8QVariantC1Ej
_ZN8QVariantC1Ex
_ZN8QVariantC1Ey
_ZN8QVariantD1Ev
_ZN8QVariantaSERKS_
_ZN9QDateTimeC1ERK5QDateRK5QTimeN2Qt8TimeSpecE
_ZN9QDateTimeD1Ev
_ZN9QHashData11free_helperEPFvPNS_4NodeEE
_ZN9QHashData11shared_nullE
_ZN9QListData11detach_growEPii
_ZN9QListData11shared_nullE
_ZN9QListData6appendEv
_ZN9QListData6detachEi
_ZN9QListData7disposeEPNS_4DataE
_ZN9QMetaType25registerNormalizedTypedefERK10QByteArrayi
_ZN9QtPrivate16QStringList_joinEPK11QStringListPK5QChari
_ZNK11QMetaObject2trEPKcS1_i
_ZNK11QObjectData17dynamicMetaObjectEv
_ZNK14QMessageLogger7warningEPKcz
_ZNK14QMessageLogger7warningEv
_ZNK5QDate3dayEv
_ZNK5QDate4yearEv
_ZNK5QDate5monthEv
_ZNK5QTime4hourEv
_ZNK5QTime4msecEv
_ZNK5QTime6minuteEv
_ZNK5QTime6secondEv
_ZNK5QTime8toStringEN2Qt10DateFormatE
_ZNK7QString10startsWithE5QCharN2Qt15CaseSensitivityE
_ZNK7QString14rightJustifiedEi5QCharb
_ZNK7QString3argERKS_i5QChar
_ZNK7QString3midEii
_ZNK7QString4leftEi
_ZNK7QString5splitE5QChar6QFlagsIN2Qt18SplitBehaviorFlagsEENS2_15CaseSensitivityE
_ZNK7QString5utf16Ev
_ZNK7QString6toUIntEPbi
_ZNK7QString7indexOfE13QLatin1StringiN2Qt15CaseSensitivityE
_ZNK7QString7indexOfE5QChariN2Qt15CaseSensitivityE
_ZNK7QString8endsWithE5QCharN2Qt15CaseSensitivityE
_ZNK7QStringeqE13QLatin1String
_ZNK8QVariant10toDateTimeEv
_ZNK8QVariant11toByteArrayEv
_ZNK8QVariant5toIntEPb
_ZNK8QVariant6isNullEv
_ZNK8QVariant6toDateEv
_ZNK8QVariant6toTimeEv
_ZNK8QVariant8toStringEv
_ZNK8QVariant8userTypeEv
_ZNK8QVariant9constDataEv
_ZNK9QDateTime4dateEv
_ZNK9QDateTime4timeEv
_ZNK9QDateTime7isValidEv
_ZeqRK7QStringS1_

qt5sql

_ZN10QSqlDriver11cancelQueryEv
_ZN10QSqlDriver11qt_metacallEN11QMetaObject4CallEiPPv
_ZN10QSqlDriver11qt_metacastEPKc
_ZN10QSqlDriver12setLastErrorERK9QSqlError
_ZN10QSqlDriver12setOpenErrorEb
_ZN10QSqlDriver16staticMetaObjectE
_ZN10QSqlDriver23subscribeToNotificationERK7QString
_ZN10QSqlDriver27unsubscribeFromNotificationERK7QString
_ZN10QSqlDriver7setOpenEb
_ZN10QSqlDriverC2ER17QSqlDriverPrivateP7QObject
_ZN10QSqlDriverD2Ev
_ZN10QSqlRecord5clearEv
_ZN10QSqlRecord6appendERK9QSqlField
_ZN10QSqlRecordC1ERKS_
_ZN10QSqlRecordC1Ev
_ZN10QSqlRecordD1Ev
_ZN10QSqlResult11savePrepareERK7QString
_ZN10QSqlResult12setLastErrorERK9QSqlError
_ZN10QSqlResult12virtual_hookEiPv
_ZN10QSqlResult14setForwardOnlyEb
_ZN10QSqlResult27setNumericalPrecisionPolicyEN4QSql24NumericalPrecisionPolicyE
_ZN10QSqlResult5setAtEi
_ZN10QSqlResult8setQueryERK7QString
_ZN10QSqlResult9bindValueERK7QStringRK8QVariant6QFlagsIN4QSql13ParamTypeFlagEE
_ZN10QSqlResult9bindValueEiRK8QVariant6QFlagsIN4QSql13ParamTypeFlagEE
_ZN10QSqlResult9execBatchEb
_ZN10QSqlResult9setActiveEb
_ZN10QSqlResult9setSelectEb
_ZN10QSqlResultC2ER17QSqlResultPrivate
_ZN10QSqlResultD2Ev
_ZN16QSqlDriverPlugin11qt_metacallEN11QMetaObject4CallEiPPv
_ZN16QSqlDriverPlugin11qt_metacastEPKc
_ZN16QSqlDriverPlugin16staticMetaObjectE
_ZN16QSqlDriverPluginC2EP7QObject
_ZN16QSqlDriverPluginD2Ev
_ZN9QSqlErrorC1ERK7QStringS2_NS_9ErrorTypeES2_
_ZN9QSqlErrorD1Ev
_ZN9QSqlField10setSqlTypeEi
_ZN9QSqlField12setAutoValueEb
_ZN9QSqlField12setPrecisionEi
_ZN9QSqlField12setTableNameERK7QString
_ZN9QSqlField17setRequiredStatusENS_14RequiredStatusE
_ZN9QSqlField9setLengthEi
_ZN9QSqlFieldC1ERK7QStringN8QVariant4TypeE
_ZN9QSqlFieldC1ERKS_
_ZN9QSqlFieldD1Ev
_ZN9QSqlIndex6appendERK9QSqlField
_ZN9QSqlIndex7setNameERK7QString
_ZN9QSqlIndexC1ERK7QStringS2_
_ZN9QSqlQuery4execERK7QString
_ZN9QSqlQuery4nextEv
_ZN9QSqlQueryC1EP10QSqlResult
_ZN9QSqlQueryD1Ev
_ZNK10QSqlDriver11formatValueERK9QSqlFieldb
_ZNK10QSqlDriver12sqlStatementENS_13StatementTypeERK7QStringRK10QSqlRecordb
_ZNK10QSqlDriver15stripDelimitersERK7QStringNS_14IdentifierTypeE
_ZNK10QSqlDriver25subscribedToNotificationsEv
_ZNK10QSqlDriver6isOpenEv
_ZNK10QSqlDriver8dbmsTypeEv
_ZNK10QSqlRecord5countEv
_ZNK10QSqlRecord5fieldERK7QString
_ZNK10QSqlRecord5fieldEi
_ZNK10QSqlResult11boundValuesEv
_ZNK10QSqlResult12hasOutValuesEv
_ZNK10QSqlResult13bindValueTypeEi
_ZNK10QSqlResult13isForwardOnlyEv
_ZNK10QSqlResult24numericalPrecisionPolicyEv
_ZNK10QSqlResult2atEv
_ZNK10QSqlResult6driverEv
_ZNK10QSqlResult8isActiveEv
_ZNK10QSqlResult8isSelectEv
_ZNK17QSqlResultPrivate11fieldSerialEi
_ZNK9QSqlField4typeEv
_ZNK9QSqlField6isNullEv
_ZNK9QSqlField6lengthEv
_ZNK9QSqlQuery5valueEi
_ZTV17QSqlResultPrivate

Exports

Exports

qt_plugin_instance
qt_plugin_query_metadata

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 117B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/16
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ccb90ffe781f68bbd91f252203a598d5

Code Sign

07:e2:ef:84:3d:0d:6f:58:cb:bb:06:e3:e8:b3:d3:20Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

ee:b9:02:5b:4b:dc:66:91:a1:02:b9:1c:58:fa:b2:2b:f5:cf:d2:83:3d:d5:e8:c6:51:ea:53:e0:ca:98:0e:e9Signer

Signature Validations

Verification

06/11/2020, 09:09 Valid: true

Chain 1

Headers

File Characteristics

Imports

kernel32

msvcrt

odbc32

libstdc++-6

qt5core

qt5sql

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 60KB

.data Size: 512B - Virtual size: 256B

.rdata Size: 8KB - Virtual size: 8KB

/4 Size: 512B - Virtual size: 128B

.pdata Size: 2KB - Virtual size: 2KB

.xdata Size: 2KB - Virtual size: 2KB

.bss Size: - Virtual size: 2KB

.edata Size: 512B - Virtual size: 117B

.idata Size: 13KB - Virtual size: 13KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 832B

.reloc Size: 512B - Virtual size: 376B

/16 Size: 512B - Virtual size: 24B

07:e2:ef:84:3d:0d:6f:58:cb:bb:06:e3:e8:b3:d3:20
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

ee:b9:02:5b:4b:dc:66:91:a1:02:b9:1c:58:fa:b2:2b:f5:cf:d2:83:3d:d5:e8:c6:51:ea:53:e0:ca:98:0e:e9
Signer

06/11/2020, 09:09
Valid: true

.text
Size: 60KB - Virtual size: 60KB

.data
Size: 512B - Virtual size: 256B

.rdata
Size: 8KB - Virtual size: 8KB

/4
Size: 512B - Virtual size: 128B

.pdata
Size: 2KB - Virtual size: 2KB

.xdata
Size: 2KB - Virtual size: 2KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 117B

.idata
Size: 13KB - Virtual size: 13KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 832B

.reloc
Size: 512B - Virtual size: 376B

/16
Size: 512B - Virtual size: 24B