fd255d03637296c6068a8c11e366d5f37cbb07c0764806f127f5bcf59581bc50

Sharing

Copy URL Twitter E-mail

General

Target

fd255d03637296c6068a8c11e366d5f37cbb07c0764806f127f5bcf59581bc50
Size

12KB
MD5

880e01a8f319c71bdaa56fa9dd98ff74
SHA1

6676822471ffaf60f3c4309d58b3bde15e033646
SHA256

fd255d03637296c6068a8c11e366d5f37cbb07c0764806f127f5bcf59581bc50
SHA512

f780cf4cd8008555f5e855f25ce15ed1491520002ec8a6f381f15b374c4a08711f64e87613e1eb65be4c99967f938579494c99a62dd394af266103479d1db68a
SSDEEP

192:THeB3r5S0Ob4B8zg/pJIBnMppJU/LeZBI9BrSV5P/a3XcDrmsCu:T+B3NS94q0xJMM5QwWsDL7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd255d03637296c6068a8c11e366d5f37cbb07c0764806f127f5bcf59581bc50

Files

fd255d03637296c6068a8c11e366d5f37cbb07c0764806f127f5bcf59581bc50
.dll windows:6 windows x64 arch:x64

6f872519d047d82a77e47484f7dc614a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Dev\work\NetVision\Dev\Install\Scripts\InnoSetup_MULTI\ProgramDir\PgBuild\postgresql\Release\test_predtest\test_predtest.pdb

Imports

postgres.exe

SPI_tuptable
SPI_processed
text_to_cstring
predicate_refuted_by
predicate_implied_by
make_ands_implicit
HeapTupleHeaderGetDatum
BlessTupleDesc
SPI_getbinval
SPI_plan_get_cached_plan
SPI_prepare
SPI_execute_plan
SPI_finish
SPI_connect
pg_detoast_datum_packed
heap_form_tuple
TupleDescInitEntry
CreateTemplateTupleDesc
elog_finish
elog_start

msvcr120

__clean_type_info_names_internal
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
__crtCapturePreviousContext
__crtCaptureCurrentContext
__crtTerminateProcess
__crtUnhandledException
__CppXcptFilter
_amsg_exit
free
_malloc_crt
_initterm
_initterm_e
__C_specific_handler
__crt_debugger_hook

kernel32

DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer

Exports

Exports

Pg_magic_func
pg_finfo_test_predtest
test_predtest

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f872519d047d82a77e47484f7dc614a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

postgres.exe

msvcr120

kernel32

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 300B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 20B

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 300B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 20B