95e5ae88dd7c8143b4409547eba957223d9aed140a0ab29c158020d85f0fc8b7

Sharing

Copy URL Twitter E-mail

General

Target

95e5ae88dd7c8143b4409547eba957223d9aed140a0ab29c158020d85f0fc8b7
Size

14KB
MD5

7f1bd980ca3d5a038cd60d87ba61f213
SHA1

854a57d449ca2715f2f3d882449086bdaed30f64
SHA256

95e5ae88dd7c8143b4409547eba957223d9aed140a0ab29c158020d85f0fc8b7
SHA512

aef4268add558bece43ddba32c51185afd02ebb4b7aeb38246f611a35d42cf1bf32eb07c4e499a7ec8a76362b5de5bd943aa9575193a481ae11a0e852daef80b
SSDEEP

192:KzD/Juh48rB8tRHodp1ys6XjcvGK9V5v4uM3XcyoHDmsg:KzD/f8d8fHoxyBzGX75wTsyoHTg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95e5ae88dd7c8143b4409547eba957223d9aed140a0ab29c158020d85f0fc8b7

Files

95e5ae88dd7c8143b4409547eba957223d9aed140a0ab29c158020d85f0fc8b7
.dll windows:6 windows x64 arch:x64

a82a1a963aa55108ada8c3578173be50

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Dev\work\NetVision\Dev\Install\Scripts\InnoSetup_MULTI\ProgramDir\PgBuild\postgresql\Release\unaccent\unaccent.pdb

Imports

postgres.exe

CurrentMemoryContext
PG_exception_stack
error_context_stack
GetSysCacheOid
get_namespace_name
get_func_namespace
cstring_to_text
get_tsearch_config_filename
tsearch_readline_end
tsearch_readline
tsearch_readline_begin
t_isspace
pg_mblen
lookup_ts_dictionary_cache
defGetString
appendBinaryStringInfo
initStringInfo
FunctionCall4Coll
pg_detoast_datum_packed
pg_detoast_datum_copy
pfree
palloc0
palloc
pg_re_throw
FlushErrorState
CopyErrorData
errmsg
errcode
errfinish
errstart

msvcr120

__clean_type_info_names_internal
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
__crtCapturePreviousContext
__crtCaptureCurrentContext
__crtTerminateProcess
__crtUnhandledException
__crt_debugger_hook
__C_specific_handler
_initterm_e
_initterm
_malloc_crt
free
_amsg_exit
__CppXcptFilter
memcpy
_setjmp

kernel32

DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer

Exports

Exports

Pg_magic_func
pg_finfo_unaccent_dict
pg_finfo_unaccent_init
pg_finfo_unaccent_lexize
unaccent_dict
unaccent_init
unaccent_lexize

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a82a1a963aa55108ada8c3578173be50

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

postgres.exe

msvcr120

kernel32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 408B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 20B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 408B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 20B