efe6629c0c4abc70a6a316e5e57963e340b60708af14ef462404e6fe4ed8f073

Sharing

Copy URL Twitter E-mail

General

Target

efe6629c0c4abc70a6a316e5e57963e340b60708af14ef462404e6fe4ed8f073
Size

871KB
MD5

de2b40a9d69f93fece0293d5ca80fe25
SHA1

8085731e09f2d707c3655a8ee2a71f91413a8e93
SHA256

efe6629c0c4abc70a6a316e5e57963e340b60708af14ef462404e6fe4ed8f073
SHA512

a5cb4b68a799d4ed342a5a6a2930af0e65e41cfa2b7f06ee24c6b72ea5948f8157565016f46aebf1454a8aba5e1ecd7126871797f7d3fc3cb1eb82c2b642c143
SSDEEP

6144:icgG2WBHouELnfMtvhKOeIzPhWGffFauKZFmGZ:iFeELnfMBheIzPhf3FDKZFH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efe6629c0c4abc70a6a316e5e57963e340b60708af14ef462404e6fe4ed8f073

Files

efe6629c0c4abc70a6a316e5e57963e340b60708af14ef462404e6fe4ed8f073
.exe windows:6 windows x64 arch:x64

ebdce9545a2110439f815437f35d66db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Dev\work\NetVision\Dev\Install\Scripts\InnoSetup_MULTI\ProgramDir\PgBuild\postgresql\Release\ecpg\ecpg.pdb

Imports

kernel32

LocalAlloc
LocalFree
GetShortPathNameA
LoadLibraryExA
FormatMessageA
CreateDirectoryA
CreateFileA
GetFileAttributesA
GetFileAttributesExA
CreateProcessA
DeviceIoControl
MoveFileExA
MultiByteToWideChar
WideCharToMultiByte
SetEnvironmentVariableA
FreeLibrary
GetModuleHandleExA
GetProcAddress
SleepEx
GetCurrentProcess
WaitForSingleObject
CreatePipe
GetLastError
DuplicateHandle
CloseHandle
ReadFile
RemoveDirectoryA
GetCurrentDirectoryA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
DecodePointer

advapi32

InitializeAcl
GetTokenInformation
GetLengthSid
GetAclInformation
GetAce
AddAce
AddAccessAllowedAceEx
SetTokenInformation

msvcr120

strncmp
strrchr
memset
strcmp
fputc
clearerr
ferror
fread
fwrite
getc
atol
strtoul
malloc
realloc
memmove
strchr
strstr
memcpy
atoi
tolower
strpbrk
_pclose
getenv
strncpy
isalpha
strtol
sprintf
strnlen
_dclass
isupper
islower
toupper
strerror
_stat64i32
_fdopen
_close
_setmode
_open_osfhandle
_wassert
strcspn
setlocale
_putenv
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__C_specific_handler
__initenv
_fmode
_commode
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCaptureCurrentContext
__crtCapturePreviousContext
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
exit
_errno
fclose
__iob_func
free
fputs
abort
strspn
_strdup
_getcwd
_unlink

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 695KB - Virtual size: 694KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ebdce9545a2110439f815437f35d66db

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

msvcr120

Sections

.text Size: 147KB - Virtual size: 147KB

.rdata Size: 695KB - Virtual size: 694KB

.data Size: 512B - Virtual size: 11KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 24KB - Virtual size: 23KB

.text
Size: 147KB - Virtual size: 147KB

.rdata
Size: 695KB - Virtual size: 694KB

.data
Size: 512B - Virtual size: 11KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 24KB - Virtual size: 23KB