ed3a46306032c7fdf8ef70d6e0bcc0c538fe74862d9524ef65a353bca0d4756d

General

Target

ed3a46306032c7fdf8ef70d6e0bcc0c538fe74862d9524ef65a353bca0d4756d
Size

10KB
MD5

755f5f4c809bcafdfcef55241517400e
SHA1

c6c817152d3826445da445b05a6aca5c480bd4be
SHA256

ed3a46306032c7fdf8ef70d6e0bcc0c538fe74862d9524ef65a353bca0d4756d
SHA512

fe42d04ffad6652b8c663d656687394fd318e424ef16010ed65cdea1889017e8337f1ac0baee0435268ec33b928ada9cbca1e35f4630a5fc08a521f468bbd19d
SSDEEP

96:aPOtRmlot54jM588GU8mZW2QMqrM85dAcHPgu+Yl/Sxu3XBg+aMpfHnfRzx:Lea5wMmc8GpIeqgNsSu3XXVP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed3a46306032c7fdf8ef70d6e0bcc0c538fe74862d9524ef65a353bca0d4756d

Files

ed3a46306032c7fdf8ef70d6e0bcc0c538fe74862d9524ef65a353bca0d4756d
.dll windows:6 windows x64 arch:x64

238270f66efd483f5d0f393d5ca5ee24

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Dev\work\NetVision\Dev\Install\Scripts\InnoSetup_MULTI\ProgramDir\PgBuild\postgresql\Release\autoinc\autoinc.pdb

Imports

postgres.exe

cstring_to_text
SPI_getrelname
SPI_gettypeid
SPI_getbinval
SPI_fnumber
nextval
DirectFunctionCall1Coll
pg_detoast_datum_packed
heap_modify_tuple_by_cols
pfree
palloc
elog_finish
elog_start
errmsg
errcode
errfinish
errstart

msvcr120

__clean_type_info_names_internal
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
__C_specific_handler
_initterm_e
_initterm
__CppXcptFilter
_amsg_exit
free
_malloc_crt

kernel32

DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
EncodePointer

Exports

Exports

Pg_magic_func
autoinc
pg_finfo_autoinc

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

238270f66efd483f5d0f393d5ca5ee24

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

postgres.exe

msvcr120

kernel32

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 88B

.pdata Size: 512B - Virtual size: 228B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 16B

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 88B

.pdata
Size: 512B - Virtual size: 228B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 16B