cygpq-5[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cygpq-5.dll
Size

161KB
MD5

6376493faec162327d756800c1d8831d
SHA1

dd93a48e4c06717cff09d93edf55a71af87d1101
SHA256

ea67580db860610be2e2f11f8bb8fd9d8142feb8def713145a4fa6d8d0906bff
SHA512

fd308ec9af2c35aeed7b589bd461678c87505f33a14fdb42422616e2fae283d14762f7aebff9200f86b513b5a389dfa4aaeafb2d1f139fbc10dcd2d85cf698df
SSDEEP

3072:AjgxWxD81tv3J3FU0qWSnC6KA0LN8IAu6sDmMA1jOd3eR:IgxWp81tv31FU0qbC//LRA1jOm

Score

1^/10

Malware Config

Signatures

Files

cygpq-5.dll
.dll windows x86

3c449a45eed51d6f7ba51adb14b46138

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

cygcrypto-1.0.0

ASN1_STRING_data
ASN1_STRING_length
BIO_clear_flags
BIO_int_ctrl
BIO_new
BIO_s_socket
BIO_set_flags
CRYPTO_get_id_callback
CRYPTO_get_locking_callback
CRYPTO_num_locks
CRYPTO_set_id_callback
CRYPTO_set_locking_callback
ENGINE_by_id
ENGINE_finish
ENGINE_free
ENGINE_init
ENGINE_load_private_key
ERR_clear_error
ERR_get_error
ERR_put_error
ERR_reason_error_string
OPENSSL_config
X509_NAME_ENTRY_get_data
X509_NAME_get_entry
X509_NAME_get_index_by_NID
X509_STORE_load_locations
X509_STORE_set_flags
X509_free
X509_get_ext_d2i
X509_get_subject_name
sk_free
sk_num
sk_value

cygwin1

__cxa_atexit
__errno
__getreent
__locale_ctype_ptr
__xpg_strerror_r
_fcntl64
_fopen64
_geteuid32
_getpwuid_r32
_impure_ptr
_open64
_stat64
abort
atoi
calloc
close
connect
cygwin_detach_dll
cygwin_internal
dll_dllcrt0
fclose
fcntl
fflush
fgets
fileno
fopen
fprintf
fputc
fputs
free
freeaddrinfo
freeifaddrs
fwrite
gai_strerror
getaddrinfo
getenv
geteuid
getifaddrs
getnameinfo
getpeereid
getpwuid_r
getsockname
getsockopt
ioctl
isatty
malloc
memchr
memcpy
memmove
memset
nl_langinfo
open
pclose
poll
popen
posix_memalign
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock
pthread_self
pthread_sigmask
putc
read
realloc
recv
send
setsockopt
sigaction
sigaddset
sigemptyset
sigismember
sigpending
sigwait
snprintf
socket
sprintf
sscanf
stat
strchr
strcmp
strcpy
strdup
strlcpy
strlen
strncat
strncmp
strncpy
strspn
strstr
strtol
strtoul
time
tolower
toupper
vsnprintf
write

cygintl-8

libintl_bindtextdomain
libintl_dgettext
libintl_dngettext
libintl_gettext
libintl_setlocale

cygldap_r-2-4-2

ldap_count_entries
ldap_err2string
ldap_first_entry
ldap_get_values_len
ldap_init
ldap_msgfree
ldap_result
ldap_search_st
ldap_set_option
ldap_simple_bind
ldap_unbind
ldap_value_free_len

cygssl-1.0.0

SSL_CIPHER_get_bits
SSL_CIPHER_get_name
SSL_CTX_ctrl
SSL_CTX_free
SSL_CTX_get_cert_store
SSL_CTX_load_verify_locations
SSL_CTX_new
SSL_CTX_use_certificate_chain_file
SSL_check_private_key
SSL_connect
SSL_ctrl
SSL_free
SSL_get_current_cipher
SSL_get_current_compression
SSL_get_error
SSL_get_peer_certificate
SSL_get_version
SSL_library_init
SSL_load_error_strings
SSL_new
SSL_pending
SSL_read
SSL_set_bio
SSL_set_ex_data
SSL_set_verify
SSL_shutdown
SSL_use_PrivateKey
SSL_use_PrivateKey_file
SSL_write
SSLv23_method

kernel32

FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA

Exports

Exports

PQbackendPID
PQbinaryTuples
PQcancel
PQclear
PQclientEncoding
PQcmdStatus
PQcmdTuples
PQconndefaults
PQconnectPoll
PQconnectStart
PQconnectStartParams
PQconnectdb
PQconnectdbParams
PQconnectionNeedsPassword
PQconnectionUsedPassword
PQconninfo
PQconninfoFree
PQconninfoParse
PQconsumeInput
PQcopyResult
PQdb
PQdescribePortal
PQdescribePrepared
PQdisplayTuples
PQdsplen
PQencryptPassword
PQendcopy
PQenv2encoding
PQerrorMessage
PQescapeBytea
PQescapeByteaConn
PQescapeIdentifier
PQescapeLiteral
PQescapeString
PQescapeStringConn
PQexec
PQexecParams
PQexecPrepared
PQfformat
PQfinish
PQfireResultCreateEvents
PQflush
PQfmod
PQfn
PQfname
PQfnumber
PQfreeCancel
PQfreeNotify
PQfreemem
PQfsize
PQftable
PQftablecol
PQftype
PQgetCancel
PQgetCopyData
PQgetResult
PQgetisnull
PQgetlength
PQgetline
PQgetlineAsync
PQgetssl
PQgetvalue
PQhost
PQinitOpenSSL
PQinitSSL
PQinstanceData
PQisBusy
PQisnonblocking
PQisthreadsafe
PQlibVersion
PQmakeEmptyPGresult
PQmblen
PQnfields
PQnotifies
PQnparams
PQntuples
PQoidStatus
PQoidValue
PQoptions
PQparameterStatus
PQparamtype
PQpass
PQping
PQpingParams
PQport
PQprepare
PQprint
PQprintTuples
PQprotocolVersion
PQputCopyData
PQputCopyEnd
PQputline
PQputnbytes
PQregisterEventProc
PQregisterThreadLock
PQrequestCancel
PQresStatus
PQreset
PQresetPoll
PQresetStart
PQresultAlloc
PQresultErrorField
PQresultErrorMessage
PQresultInstanceData
PQresultSetInstanceData
PQresultStatus
PQresultVerboseErrorMessage
PQsendDescribePortal
PQsendDescribePrepared
PQsendPrepare
PQsendQuery
PQsendQueryParams
PQsendQueryPrepared
PQserverVersion
PQsetClientEncoding
PQsetErrorContextVisibility
PQsetErrorVerbosity
PQsetInstanceData
PQsetNoticeProcessor
PQsetNoticeReceiver
PQsetResultAttrs
PQsetSingleRowMode
PQsetdbLogin
PQsetnonblocking
PQsetvalue
PQsocket
PQsslAttribute
PQsslAttributeNames
PQsslInUse
PQsslStruct
PQstatus
PQtrace
PQtransactionStatus
PQtty
PQunescapeBytea
PQuntrace
PQuser
__gcc_deregister_frame
__gcc_register_frame
appendBinaryPQExpBuffer
appendPQExpBuffer
appendPQExpBufferChar
appendPQExpBufferStr
createPQExpBuffer
destroyPQExpBuffer
enlargePQExpBuffer
hmod_libgcc
inet_net_ntop
initPQExpBuffer
libpq_gettext
libpq_ngettext
lo_close
lo_creat
lo_create
lo_export
lo_import
lo_import_with_oid
lo_lseek
lo_lseek64
lo_open
lo_read
lo_tell
lo_tell64
lo_truncate
lo_truncate64
lo_unlink
lo_write
pg_ascii_tolower
pg_ascii_toupper
pg_char_to_encoding
pg_enc2gettext_tbl
pg_enc2name_tbl
pg_encoding_dsplen
pg_encoding_max_length
pg_encoding_mblen
pg_encoding_to_char
pg_encoding_verifymb
pg_fe_getauthname
pg_fe_sendauth
pg_foreach_ifaddr
pg_freeaddrinfo_all
pg_g_threadlock
pg_get_encoding_from_locale
pg_getaddrinfo_all
pg_getnameinfo_all
pg_md5_binary
pg_md5_encrypt
pg_md5_hash
pg_mic_mblen
pg_mule_mblen
pg_range_sockaddr
pg_set_block
pg_set_noblock
pg_sockaddr_cidr_mask
pg_strcasecmp
pg_strncasecmp
pg_tolower
pg_toupper
pg_utf8_islegal
pg_utf_mblen
pg_valid_client_encoding
pg_valid_server_encoding
pg_valid_server_encoding_id
pg_wchar_table
pgresStatus
pgtls_close
pgtls_init
pgtls_init_library
pgtls_open_client
pgtls_read
pgtls_read_pending
pgtls_write
pqBuildErrorMessage3
pqBuildStartupPacket2
pqBuildStartupPacket3
pqCatenateResultError
pqCheckInBufferSpace
pqCheckOutBufferSpace
pqClearAsyncResult
pqDropConnection
pqEndcopy2
pqEndcopy3
pqFlush
pqFunctionCall2
pqFunctionCall3
pqGetCopyData2
pqGetCopyData3
pqGetErrorNotice3
pqGetHomeDirectory
pqGetInt
pqGetc
pqGetline2
pqGetline3
pqGetlineAsync2
pqGetlineAsync3
pqGetnchar
pqGetpwuid
pqGets
pqGets_append
pqHandleSendFailure
pqInternalNotice
pqPacketSend
pqParseInput2
pqParseInput3
pqPrepareAsyncResult
pqPutInt
pqPutMsgEnd
pqPutMsgStart
pqPutc
pqPutnchar
pqPuts
pqReadData
pqReadReady
pqResultAlloc
pqResultStrdup
pqRowProcessor
pqSaveErrorResult
pqSaveMessageField
pqSaveParameterStatus
pqSetResultError
pqSetenvPoll
pqSkipnchar
pqStrerror
pqWait
pqWaitTimed
pqWriteReady
pq_block_sigpipe
pq_reset_sigpipe
pqsecure_close
pqsecure_initialize
pqsecure_open_client
pqsecure_raw_read
pqsecure_raw_write
pqsecure_read
pqsecure_write
pqsignal
printfPQExpBuffer
resetPQExpBuffer
termPQExpBuffer
unicode_to_utf8
utf8_to_unicode

Sections

.text
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 348B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3c449a45eed51d6f7ba51adb14b46138

Headers

File Characteristics

Imports

cygcrypto-1.0.0

cygwin1

cygintl-8

cygldap_r-2-4-2

cygssl-1.0.0

kernel32

Exports

Exports

Sections

.text Size: 99KB - Virtual size: 98KB

.data Size: 512B - Virtual size: 132B

.rdata Size: 23KB - Virtual size: 22KB

.buildid Size: 512B - Virtual size: 53B

/4 Size: 20KB - Virtual size: 20KB

.bss Size: - Virtual size: 348B

.edata Size: 7KB - Virtual size: 6KB

.idata Size: 5KB - Virtual size: 5KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 99KB - Virtual size: 98KB

.data
Size: 512B - Virtual size: 132B

.rdata
Size: 23KB - Virtual size: 22KB

.buildid
Size: 512B - Virtual size: 53B

/4
Size: 20KB - Virtual size: 20KB

.bss
Size: - Virtual size: 348B

.edata
Size: 7KB - Virtual size: 6KB

.idata
Size: 5KB - Virtual size: 5KB

.reloc
Size: 4KB - Virtual size: 3KB