mysqldump[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

mysqldump.exe
Size

2.0MB
MD5

c2b7147a54741ae0c86a9c477af1073e
SHA1

cdf0055f7fac6c6584342fceb538dfd6df932577
SHA256

17626c20c84c598cfd46e1c66d9b36281684d8e8e084bc02b05499d2ce498053
SHA512

0d78dd3c3d6f77e3f704be67d84858bafd3ceedf31acefc0e397336671993bae02dfca2e9e0f5b93238a713d96ac7c0746441475ffac0768ad9d0333c6411f1f
SSDEEP

24576:olXGrTOWgUsTPyCJk9TOeRNGatTfcy8KulflHfwPa:M2nOWhCJOTrRJtrcVFfNwi

Score

1^/10

Malware Config

Signatures

Files

mysqldump.exe
.exe windows:4 windows x86

46228e3caea7d183b158b70c2e036342

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

11:1d:30:d7:f1:6f:cc:0e:8d:77:7b:1f:53:0c:3f:f9
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

01/07/2009, 17:20

Not After

28/06/2010, 22:05

Subject

CN=MySQL AB,OU=Engineering,O=MySQL AB,L=Uppsala,ST=Uppsala,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:17:6c:a8:65:15:aa:67:63:11:ac:30:1e:ca:1d:a6:50:12:86:c2
Signer

Actual PE Digest

41:17:6c:a8:65:15:aa:67:63:11:ac:30:1e:ca:1d:a6:50:12:86:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

inet_addr
WSASetLastError
gethostbyname
getpeername
shutdown
closesocket
setsockopt
send
recv
select
__WSAFDIsSet
inet_ntoa
getservbyname
ntohs
WSAStartup
WSACleanup
socket
WSAGetLastError
ioctlsocket
htons
connect

kernel32

PeekNamedPipe
GetDriveTypeA
GetCurrentDirectoryA
GetFullPathNameA
SetCurrentDirectoryA
GetConsoleMode
GetFileInformationByHandle
GetLocaleInfoW
SetEndOfFile
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
CompareStringW
CompareStringA
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
CloseHandle
SetNamedPipeHandleState
WaitNamedPipeA
CreateFileA
GetLastError
UnmapViewOfFile
WaitForSingleObject
SetEvent
MapViewOfFile
OpenFileMappingA
OpenEventA
InterlockedIncrement
DeleteFileA
MoveFileA
GetTickCount
CreateEventA
InitializeCriticalSection
DeleteCriticalSection
ResetEvent
WaitForMultipleObjects
GetSystemTimeAsFileTime
FindClose
FindNextFileA
FindFirstFileA
ReadFile
WriteFile
GetFileAttributesExA
GetFileAttributesA
Sleep
TryEnterCriticalSection
SetThreadPriority
GetCurrentThreadId
QueryPerformanceCounter
QueryPerformanceFrequency
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersionExA
HeapAlloc
HeapFree
WideCharToMultiByte
GetTimeZoneInformation
SetConsoleCtrlHandler
ReadConsoleInputA
SetConsoleMode
SetEnvironmentVariableW
PeekConsoleInputA
GetNumberOfConsoleInputEvents
WriteConsoleA
SetStdHandle
GetFileType
FileTimeToSystemTime
FileTimeToLocalFileTime
HeapReAlloc
ExitThread
ResumeThread
CreateThread
RtlUnwind
SetHandleCount
GetStdHandle
GetStartupInfoA
FatalAppExitA
GetCurrentProcessId
TlsAlloc
SetLastError
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
FlushFileBuffers
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
VirtualProtect
GetSystemInfo
VirtualQuery
SetFilePointer
RaiseException
InterlockedExchange
HeapSize
LoadLibraryA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetCPInfo
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetACP
GetOEMCP

advapi32

RegEnumValueA
RegOpenKeyExA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
RegCloseKey

Sections

.text
Size: 644KB - Virtual size: 642KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 911B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

46228e3caea7d183b158b70c2e036342

Code Sign

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

11:1d:30:d7:f1:6f:cc:0e:8d:77:7b:1f:53:0c:3f:f9Certificate

Extended Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:17:6c:a8:65:15:aa:67:63:11:ac:30:1e:ca:1d:a6:50:12:86:c2Signer

Headers

File Characteristics

Imports

wsock32

kernel32

advapi32

Sections

.text Size: 644KB - Virtual size: 642KB

.rdata Size: 120KB - Virtual size: 118KB

.data Size: 1.2MB - Virtual size: 1.2MB

.idata Size: 8KB - Virtual size: 4KB

.tls Size: 4KB - Virtual size: 911B

.rsrc Size: 4KB - Virtual size: 572B

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

11:1d:30:d7:f1:6f:cc:0e:8d:77:7b:1f:53:0c:3f:f9
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:17:6c:a8:65:15:aa:67:63:11:ac:30:1e:ca:1d:a6:50:12:86:c2
Signer

.text
Size: 644KB - Virtual size: 642KB

.rdata
Size: 120KB - Virtual size: 118KB

.data
Size: 1.2MB - Virtual size: 1.2MB

.idata
Size: 8KB - Virtual size: 4KB

.tls
Size: 4KB - Virtual size: 911B

.rsrc
Size: 4KB - Virtual size: 572B