67073fd895ba6fc811ebb85df52e2ab28af4be647957576f0b59bc9098d9a738

Sharing

Copy URL Twitter E-mail

General

Target

67073fd895ba6fc811ebb85df52e2ab28af4be647957576f0b59bc9098d9a738
Size

16KB
MD5

4912b2b23d02646de03291b5072f2bf2
SHA1

f57abee17c85414f16c642646ff78543f21f4ccc
SHA256

67073fd895ba6fc811ebb85df52e2ab28af4be647957576f0b59bc9098d9a738
SHA512

3980807d23dfee081bf681ef8095a09d020597246755c372573a7066540c0f02afcf4763c9a4bb9b39c7d2d71619f06dc145cc1023f4bda50ee5222122b2bc40
SSDEEP

192:/iPKIcuwX4l0dbkclgD3BiF1vZpTfw4e/TjUa3XcMFHQ:qPKCwX4l0dg5xy1rf+TsMFHQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
67073fd895ba6fc811ebb85df52e2ab28af4be647957576f0b59bc9098d9a738

Files

67073fd895ba6fc811ebb85df52e2ab28af4be647957576f0b59bc9098d9a738
.dll windows:6 windows x64 arch:x64

fc7f9d179be5898aeb623ded0f9d6dc5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Dev\work\NetVision\Dev\Install\Scripts\InnoSetup_MULTI\ProgramDir\PgBuild\postgresql\Release\sslinfo\sslinfo.pdb

Imports

ssleay32

ord130
ord71
ord127

libeay32

ord86
ord129
ord1002
ord9
ord2432
ord361
ord363
ord364
ord366
ord95
ord653
ord657
ord576
ord579
ord578
ord567
ord566
ord652
ord648
ord544
ord542
ord1180
ord52
ord109
ord66
ord78
ord181
ord656

postgres.exe

MyProcPort
CurrentMemoryContext
text_to_cstring
cstring_to_text_with_len
cstring_to_text
numeric_in
pg_any_to_server
end_MultiFuncCall
per_MultiFuncCall
init_MultiFuncCall
HeapTupleHeaderGetDatum
BlessTupleDesc
get_call_result_type
pg_detoast_datum_packed
heap_form_tuple
pfree
palloc
elog_finish
elog_start
errmsg
errcode
errfinish
errstart
DirectFunctionCall3Coll

msvcr120

__crtCapturePreviousContext
free
_amsg_exit
__CppXcptFilter
__clean_type_info_names_internal
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
_malloc_crt
__crtCaptureCurrentContext
__crtTerminateProcess
__crtUnhandledException
__crt_debugger_hook
__C_specific_handler
_initterm_e
_initterm

kernel32

EncodePointer
DecodePointer
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
IsProcessorFeaturePresent

Exports

Exports

Pg_magic_func
pg_finfo_ssl_cipher
pg_finfo_ssl_client_cert_present
pg_finfo_ssl_client_dn
pg_finfo_ssl_client_dn_field
pg_finfo_ssl_client_serial
pg_finfo_ssl_extension_info
pg_finfo_ssl_is_used
pg_finfo_ssl_issuer_dn
pg_finfo_ssl_issuer_field
pg_finfo_ssl_version
ssl_cipher
ssl_client_cert_present
ssl_client_dn
ssl_client_dn_field
ssl_client_serial
ssl_extension_info
ssl_is_used
ssl_issuer_dn
ssl_issuer_field
ssl_version

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc7f9d179be5898aeb623ded0f9d6dc5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ssleay32

libeay32

postgres.exe

msvcr120

kernel32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 552B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 20B

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 552B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 20B