C:\Dev\work\NetVision\Dev\Install\Scripts\InnoSetup_MULTI\ProgramDir\PgBuild\postgresql\Release\pgbench\pgbench.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5b39bb52c0da208671ad3aec37ea106fb352e88906ad0e6237e420f7423b5a6c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5b39bb52c0da208671ad3aec37ea106fb352e88906ad0e6237e420f7423b5a6c.exe
Resource
win10v2004-20231222-en
General
-
Target
5b39bb52c0da208671ad3aec37ea106fb352e88906ad0e6237e420f7423b5a6c
-
Size
191KB
-
MD5
a30681fa0da352bfe591289208b5f5e1
-
SHA1
44fb1444925f6bd112ef00f8e8ad38f210fce9fd
-
SHA256
5b39bb52c0da208671ad3aec37ea106fb352e88906ad0e6237e420f7423b5a6c
-
SHA512
5feaa580cb1141d13632e31c7ce20ed71e24edfbc1c6628bfd3fe9d33bbe99dce78e4b83f3d2500bda68bcbb49d52256c24bd82f5e9c07e8cd113b853243ed71
-
SSDEEP
3072:bx+xplKgfo/CBbvocPhHYehQMU5bR6mlz1gsqp6OuKZkcQQdCDnO5oZ:bxW/fo/WbAzSQZ06OuKZkBSGZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b39bb52c0da208671ad3aec37ea106fb352e88906ad0e6237e420f7423b5a6c
Files
-
5b39bb52c0da208671ad3aec37ea106fb352e88906ad0e6237e420f7423b5a6c.exe windows:6 windows x64 arch:x64
1a37c41b4421e1f751bb647c731edc36
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
libpq
ord139
ord64
ord74
ord68
ord75
ord67
ord69
ord155
ord95
ord48
ord45
ord37
ord35
ord34
ord106
ord33
ord31
ord28
ord26
ord25
ord24
ord111
ord102
ord23
ord118
ord21
ord140
ord16
ord15
ord14
ord7
ord4
ord156
ord70
ws2_32
__WSAFDIsSet
select
kernel32
IsProcessorFeaturePresent
DecodePointer
WideCharToMultiByte
MultiByteToWideChar
MoveFileExA
LocalFree
DeviceIoControl
RemoveDirectoryA
GetFileAttributesExA
GetFileAttributesA
CreateDirectoryA
GetProcAddress
GetModuleHandleA
GetSystemTimeAsFileTime
CreateFileA
FormatMessageA
LoadLibraryExA
SleepEx
GetShortPathNameA
SetConsoleMode
GetConsoleMode
GetStdHandle
CreateTimerQueueTimer
CreateTimerQueue
WaitForSingleObject
QueryPerformanceFrequency
QueryPerformanceCounter
GetLastError
CloseHandle
EncodePointer
GetCurrentProcessId
GetCurrentThreadId
IsDebuggerPresent
advapi32
CryptGenRandom
CryptAcquireContextA
msvcr120
fread
getc
_errno
exit
free
malloc
realloc
memcpy
memset
fclose
fgets
fputc
_pclose
puts
ferror
atof
atoi
bsearch
getenv
strtod
strtol
memmove
strchr
strcspn
strncmp
strncpy
strrchr
isdigit
isspace
_beginthreadex
_dclass
rint
_time64
ceil
exp
floor
log
pow
sin
sqrt
strcmp
strstr
fflush
setvbuf
strtok
_vacopy
isupper
islower
toupper
tolower
fwrite
sprintf
strnlen
abort
isalpha
strerror
_fileno
fputs
_get_osfhandle
_fdopen
_close
_setmode
_open_osfhandle
_wassert
_popen
system
ldexp
_stat64i32
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCaptureCurrentContext
__crtCapturePreviousContext
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__C_specific_handler
__initenv
_fmode
_commode
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
clearerr
__iob_func
_getpid
_isatty
_getcwd
sscanf
_strdup
_unlink
Sections
.text Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ