99d4a827d1db0fe24f773a0f68217f3ff4a914a79321b5bf73bae3fb35ed31c5

Sharing

Copy URL Twitter E-mail

General

Target

99d4a827d1db0fe24f773a0f68217f3ff4a914a79321b5bf73bae3fb35ed31c5
Size

17KB
MD5

4074ee22f5d8c22085f87d922431f1e8
SHA1

043dc66f7c7d98fa61427c4dbf098be912d61bd0
SHA256

99d4a827d1db0fe24f773a0f68217f3ff4a914a79321b5bf73bae3fb35ed31c5
SHA512

4e70a78a1156378a84ab9bdfdd5ef8f35e5af64e4999b078b2dfee0a6a020a5a5f4ee3734eb86bae112d93ee3f6d52b7735e53a714de3d8c63b21f04be4172c4
SSDEEP

384:SGuBIwVLrcjRNJJTBDtpBPKMVKAbR7YE9UYTsHeNP:yI+LriRpTB52MVvtYCUYTg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
99d4a827d1db0fe24f773a0f68217f3ff4a914a79321b5bf73bae3fb35ed31c5

Files

99d4a827d1db0fe24f773a0f68217f3ff4a914a79321b5bf73bae3fb35ed31c5
.dll windows:6 windows x64 arch:x64

9d169f68fb6b97e672b33e8818824a0f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Dev\work\NetVision\Dev\Install\Scripts\InnoSetup_MULTI\ProgramDir\PgBuild\postgresql\Release\refint\refint.pdb

Imports

postgres.exe

SPI_result
SPI_processed
pg_strtoint32
SPI_getrelname
SPI_gettypeid
SPI_gettype
SPI_getbinval
SPI_getvalue
SPI_fnumber
SPI_result_code_string
SPI_keepplan
SPI_prepare
SPI_execp
SPI_finish
SPI_connect
palloc
elog_finish
elog_start
errdetail
errmsg
errcode
errfinish
errstart
pg_snprintf

msvcr120

__CppXcptFilter
__clean_type_info_names_internal
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
__crtCapturePreviousContext
__crtCaptureCurrentContext
__crtTerminateProcess
__crtUnhandledException
__crt_debugger_hook
__C_specific_handler
_initterm_e
malloc
realloc
tolower
strcmp
_strdup
_amsg_exit
free
_malloc_crt
_initterm

kernel32

GetCurrentProcessId
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
EncodePointer
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer

Exports

Exports

Pg_magic_func
check_foreign_key
check_primary_key
pg_finfo_check_foreign_key
pg_finfo_check_primary_key

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d169f68fb6b97e672b33e8818824a0f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

postgres.exe

msvcr120

kernel32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 336B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 20B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 336B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 20B