1c5772af0189f365a04b4272067d68d573715aa141ae7809d7000251344cbfbe

Sharing

Copy URL Twitter E-mail

General

Target

1c5772af0189f365a04b4272067d68d573715aa141ae7809d7000251344cbfbe
Size

28KB
MD5

d871eadbf2fc893918d7e77908d0f05f
SHA1

f81299ba63625947c48b690a4c10d44200550cbc
SHA256

1c5772af0189f365a04b4272067d68d573715aa141ae7809d7000251344cbfbe
SHA512

b78e7c2481e5b9b8928220ff0ec47032bcc06c828cba3b671d96886d877eb2e63487810c6f2fcab5fb24dbdbf5aef57ba45d057a2f29b02711dbf267d80d6e1e
SSDEEP

384:Z+LZRv5tIuCGLUXJetA2UxQbm02mLqX81b2kbMGU2UTTNtKw6TsuKJ:Z+FRBmICBxQdbb2kbXwBth6T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c5772af0189f365a04b4272067d68d573715aa141ae7809d7000251344cbfbe

Files

1c5772af0189f365a04b4272067d68d573715aa141ae7809d7000251344cbfbe
.dll windows:6 windows x64 arch:x64

df657d19bbb93f85eeb34ca76d900157

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Dev\work\NetVision\Dev\Install\Scripts\InnoSetup_MULTI\ProgramDir\PgBuild\postgresql\Release\fuzzystrmatch\fuzzystrmatch.pdb

Imports

postgres.exe

varstr_levenshtein_less_equal
varstr_levenshtein
elog_finish
elog_start
errmsg
errcode
errfinish
errstart
text_to_cstring
cstring_to_text
pg_detoast_datum_packed
repalloc
palloc

msvcr120

__clean_type_info_names_internal
_onexit
__dllonexit
_calloc_crt
strncmp
strstr
toupper
memcpy
isalpha
__CppXcptFilter
_amsg_exit
free
_malloc_crt
_initterm
_initterm_e
__C_specific_handler
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCaptureCurrentContext
__crtCapturePreviousContext
_lock
_unlock

kernel32

DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer

Exports

Exports

Pg_magic_func
difference
dmetaphone
dmetaphone_alt
levenshtein
levenshtein_less_equal
levenshtein_less_equal_with_costs
levenshtein_with_costs
metaphone
pg_finfo_difference
pg_finfo_dmetaphone
pg_finfo_dmetaphone_alt
pg_finfo_levenshtein
pg_finfo_levenshtein_less_equal
pg_finfo_levenshtein_less_equal_with_costs
pg_finfo_levenshtein_with_costs
pg_finfo_metaphone
pg_finfo_soundex
soundex

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df657d19bbb93f85eeb34ca76d900157

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

postgres.exe

msvcr120

kernel32

Exports

Exports

Sections

.text Size: 19KB - Virtual size: 18KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 648B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 32B

.text
Size: 19KB - Virtual size: 18KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 648B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 32B