libpq[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

libpq.dll
Size

845KB
MD5

66b2314ab95024d05de9e4a7a650fc76
SHA1

cc847e33fc1e3a02fd1ebb4d62f13db1014a3128
SHA256

caf63a36feacbe53e20341d8d93acc77f48bd189482cb03b60fca15925b360e5
SHA512

8afb2de4480c1cdbbe2d32c13e47002bbde14e752d52619a4a4ffc361172c25b27de2bd879ed50e210edd35d74474491e23a3d5243a541d05eeeaa3b7237f938
SSDEEP

12288:rrLHr/VGd9Ek9Ac3Z76t+srFgD5cjswPNbutpzwk3Ta77Hp0fWAUmBZmGM83KJ2M:rHGarFu2vNbutqY3KJ2qwDZ4

Score

1^/10

Malware Config

Signatures

Files

libpq.dll
.dll windows x64

f221b5733ed02b6ae59b141598618589

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

GetUserNameA

kernel32

CloseHandle
CreateDirectoryA
CreateFileA
DeleteCriticalSection
DeviceIoControl
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentThreadId
GetFileAttributesA
GetFileAttributesExA
GetLastError
GetProcAddress
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LocalFree
MoveFileExA
MultiByteToWideChar
RemoveDirectoryA
Sleep
SleepEx
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_assert
_close
_errno
_fdopen
_fileno
_initterm
_isatty
_lock
_open_osfhandle
_pclose
_popen
_read
_setmode
_stat64
_strdup
_time64
_unlink
_unlock
_write
abort
atoi
bsearch
calloc
fclose
feof
ferror
fflush
fgets
fputc
fputs
free
fwrite
getc
getenv
isalnum
isalpha
islower
isspace
isupper
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putc
realloc
setlocale
signal
strchr
strcmp
strcpy
strerror
strlen
strncat
strncmp
strncpy
strrchr
strspn
strstr
strtol
strtoul
system
tolower
toupper
ungetc
vfprintf
wcslen

secur32

AcquireCredentialsHandleA
DeleteSecurityContext
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextA

shell32

SHGetFolderPathA

ws2_32

WSAGetLastError
WSAIoctl
WSASetLastError
WSAStartup
closesocket
connect
gethostbyname
getsockname
getsockopt
ioctlsocket
recv
select
send
setsockopt
socket

libcrypto-1_1-x64

ASN1_STRING_get0_data
ASN1_STRING_length
BIO_clear_flags
BIO_get_data
BIO_get_new_index
BIO_int_ctrl
BIO_meth_free
BIO_meth_get_callback_ctrl
BIO_meth_get_create
BIO_meth_get_ctrl
BIO_meth_get_destroy
BIO_meth_get_gets
BIO_meth_get_puts
BIO_meth_new
BIO_meth_set_callback_ctrl
BIO_meth_set_create
BIO_meth_set_ctrl
BIO_meth_set_destroy
BIO_meth_set_gets
BIO_meth_set_puts
BIO_meth_set_read
BIO_meth_set_write
BIO_new
BIO_s_socket
BIO_set_data
BIO_set_flags
ENGINE_by_id
ENGINE_finish
ENGINE_free
ENGINE_init
ENGINE_load_private_key
ERR_clear_error
ERR_get_error
ERR_put_error
ERR_reason_error_string
EVP_get_digestbyname
EVP_sha256
GENERAL_NAME_free
OBJ_find_sigid_algs
OBJ_nid2sn
OPENSSL_sk_num
OPENSSL_sk_pop_free
OPENSSL_sk_value
RAND_bytes
RAND_poll
RAND_status
SHA224_Final
SHA224_Init
SHA224_Update
SHA256_Final
SHA256_Init
SHA256_Update
SHA384_Final
SHA384_Init
SHA384_Update
SHA512_Final
SHA512_Init
SHA512_Update
X509_NAME_ENTRY_get_data
X509_NAME_get_entry
X509_NAME_get_index_by_NID
X509_STORE_load_locations
X509_STORE_set_flags
X509_digest
X509_free
X509_get_ext_d2i
X509_get_signature_nid
X509_get_subject_name

libssl-1_1-x64

OPENSSL_init_ssl
SSL_CIPHER_get_bits
SSL_CIPHER_get_name
SSL_CTX_ctrl
SSL_CTX_free
SSL_CTX_get_cert_store
SSL_CTX_load_verify_locations
SSL_CTX_new
SSL_CTX_set_options
SSL_CTX_use_certificate_chain_file
SSL_check_private_key
SSL_clear_options
SSL_connect
SSL_free
SSL_get_current_cipher
SSL_get_current_compression
SSL_get_error
SSL_get_peer_certificate
SSL_get_version
SSL_new
SSL_pending
SSL_read
SSL_set_bio
SSL_set_ex_data
SSL_set_options
SSL_set_verify
SSL_shutdown
SSL_use_PrivateKey
SSL_use_PrivateKey_file
SSL_write
TLS_method

libxml2-2

DllMain

Exports

Exports

PQbackendPID
PQbinaryTuples
PQcancel
PQclear
PQclientEncoding
PQcmdStatus
PQcmdTuples
PQconndefaults
PQconnectPoll
PQconnectStart
PQconnectStartParams
PQconnectdb
PQconnectdbParams
PQconnectionNeedsPassword
PQconnectionUsedPassword
PQconninfo
PQconninfoFree
PQconninfoParse
PQconsumeInput
PQcopyResult
PQdb
PQdescribePortal
PQdescribePrepared
PQdisplayTuples
PQdsplen
PQencryptPassword
PQencryptPasswordConn
PQendcopy
PQenv2encoding
PQerrorMessage
PQescapeBytea
PQescapeByteaConn
PQescapeIdentifier
PQescapeLiteral
PQescapeString
PQescapeStringConn
PQexec
PQexecParams
PQexecPrepared
PQfformat
PQfinish
PQfireResultCreateEvents
PQflush
PQfmod
PQfn
PQfname
PQfnumber
PQfreeCancel
PQfreeNotify
PQfreemem
PQfsize
PQftable
PQftablecol
PQftype
PQgetCancel
PQgetCopyData
PQgetResult
PQgetgssctx
PQgetisnull
PQgetlength
PQgetline
PQgetlineAsync
PQgetssl
PQgetvalue
PQgssEncInUse
PQhost
PQhostaddr
PQinitOpenSSL
PQinitSSL
PQinstanceData
PQisBusy
PQisnonblocking
PQisthreadsafe
PQlibVersion
PQmakeEmptyPGresult
PQmblen
PQnfields
PQnotifies
PQnparams
PQntuples
PQoidStatus
PQoidValue
PQoptions
PQparameterStatus
PQparamtype
PQpass
PQping
PQpingParams
PQport
PQprepare
PQprint
PQprintTuples
PQprotocolVersion
PQputCopyData
PQputCopyEnd
PQputline
PQputnbytes
PQregisterEventProc
PQregisterThreadLock
PQrequestCancel
PQresStatus
PQreset
PQresetPoll
PQresetStart
PQresultAlloc
PQresultErrorField
PQresultErrorMessage
PQresultInstanceData
PQresultMemorySize
PQresultSetInstanceData
PQresultStatus
PQresultVerboseErrorMessage
PQsendDescribePortal
PQsendDescribePrepared
PQsendPrepare
PQsendQuery
PQsendQueryParams
PQsendQueryPrepared
PQserverVersion
PQsetClientEncoding
PQsetErrorContextVisibility
PQsetErrorVerbosity
PQsetInstanceData
PQsetNoticeProcessor
PQsetNoticeReceiver
PQsetResultAttrs
PQsetSingleRowMode
PQsetdbLogin
PQsetnonblocking
PQsetvalue
PQsocket
PQsslAttribute
PQsslAttributeNames
PQsslInUse
PQsslStruct
PQstatus
PQtrace
PQtransactionStatus
PQtty
PQunescapeBytea
PQuntrace
PQuser
appendBinaryPQExpBuffer
appendPQExpBuffer
appendPQExpBufferChar
appendPQExpBufferStr
createPQExpBuffer
destroyPQExpBuffer
enlargePQExpBuffer
initPQExpBuffer
lo_close
lo_creat
lo_create
lo_export
lo_import
lo_import_with_oid
lo_lseek
lo_lseek64
lo_open
lo_read
lo_tell
lo_tell64
lo_truncate
lo_truncate64
lo_unlink
lo_write
pg_char_to_encoding
pg_encoding_to_char
pg_utf_mblen
pg_valid_server_encoding
pg_valid_server_encoding_id
pgresStatus
pqsignal
printfPQExpBuffer
resetPQExpBuffer
termPQExpBuffer

Sections

.text
Size: 225KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f221b5733ed02b6ae59b141598618589

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

secur32

shell32

ws2_32

libcrypto-1_1-x64

libssl-1_1-x64

libxml2-2

Exports

Exports

Sections

.text Size: 225KB - Virtual size: 224KB

.data Size: 1KB - Virtual size: 1KB

.rdata Size: 118KB - Virtual size: 118KB

.pdata Size: 8KB - Virtual size: 7KB

.xdata Size: 8KB - Virtual size: 7KB

.bss Size: - Virtual size: 3KB

.edata Size: 4KB - Virtual size: 4KB

.idata Size: 8KB - Virtual size: 8KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 808B

.reloc Size: 2KB - Virtual size: 1KB

/4 Size: 2KB - Virtual size: 1KB

/19 Size: 94KB - Virtual size: 94KB

/31 Size: 15KB - Virtual size: 15KB

/45 Size: 55KB - Virtual size: 55KB

/57 Size: 11KB - Virtual size: 11KB

/70 Size: 2KB - Virtual size: 2KB

/81 Size: 170KB - Virtual size: 169KB

/92 Size: 9KB - Virtual size: 8KB

.text
Size: 225KB - Virtual size: 224KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 118KB - Virtual size: 118KB

.pdata
Size: 8KB - Virtual size: 7KB

.xdata
Size: 8KB - Virtual size: 7KB

.bss
Size: - Virtual size: 3KB

.edata
Size: 4KB - Virtual size: 4KB

.idata
Size: 8KB - Virtual size: 8KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 808B

.reloc
Size: 2KB - Virtual size: 1KB

/4
Size: 2KB - Virtual size: 1KB

/19
Size: 94KB - Virtual size: 94KB

/31
Size: 15KB - Virtual size: 15KB

/45
Size: 55KB - Virtual size: 55KB

/57
Size: 11KB - Virtual size: 11KB

/70
Size: 2KB - Virtual size: 2KB

/81
Size: 170KB - Virtual size: 169KB

/92
Size: 9KB - Virtual size: 8KB