c3c9bebc1fb45d218e80b5a14da9ea4e46c26de1be7a28743aa392fd6d6154e5

Sharing

Copy URL Twitter E-mail

General

Target

c3c9bebc1fb45d218e80b5a14da9ea4e46c26de1be7a28743aa392fd6d6154e5
Size

86KB
MD5

07585714223ca6d5b2a7ea8768c473fe
SHA1

7063232b895981442e52968954e57ae64dbc0523
SHA256

c3c9bebc1fb45d218e80b5a14da9ea4e46c26de1be7a28743aa392fd6d6154e5
SHA512

e52ba23c6fc4c568759faa2b973f51006d9063e67c989f1aff672477f10e7de287412dc43cd5768fe895503a73edafc770c245536e3ad00c5c39a112b2499e31
SSDEEP

1536:euR19lPiNa8YfEgx3Y2rNiQTENKZCYW1akqAeeLuB5oGqZ:euR19DFY2rNiQT8KZMBO5oZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c3c9bebc1fb45d218e80b5a14da9ea4e46c26de1be7a28743aa392fd6d6154e5

Files

c3c9bebc1fb45d218e80b5a14da9ea4e46c26de1be7a28743aa392fd6d6154e5
.exe windows:6 windows x64 arch:x64

fcadefedb02feacc0bb5d2199d12bfd6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\pginstaller.auto\postgres.windows-x64\Release\pg_isready\pg_isready.pdb

Imports

libintl-8

libintl_textdomain
libintl_ngettext
libintl_gettext
libintl_bindtextdomain

libpq

ord159
ord152
ord3
ord75
ord67
ord69
ord64
ord48
ord45
ord34
ord33
ord21
ord72
ord140
ord15
ord113
ord14
ord126
ord77
ord76
ord70
ord130
ord91
ord122
ord156
ord4
ord120
ord121
ord68

kernel32

DecodePointer
GetSystemTimeAsFileTime
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
SleepEx
WideCharToMultiByte
MultiByteToWideChar
MoveFileExA
FormatMessageA
DeviceIoControl
RemoveDirectoryA
GetFileAttributesExA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetConsoleCtrlHandler
GetCurrentDirectoryA
ReadFile
CloseHandle
DuplicateHandle
GetLastError
CreatePipe
WaitForSingleObject
GetCurrentProcess
CreateProcessA
LocalAlloc
LocalFree
GetShortPathNameA
GetConsoleMode
SetConsoleMode
SetEnvironmentVariableA
FreeLibrary
GetModuleHandleExA
GetProcAddress
CreateDirectoryA
CreateFileA
GetFileAttributesA

advapi32

AddAce
GetAce
GetAclInformation
GetLengthSid
GetTokenInformation
InitializeAcl
SetTokenInformation
AddAccessAllowedAceEx

msvcr120

free
malloc
strspn
strstr
isupper
realloc
memset
fputc
_pclose
_errno
getenv
strerror
strncpy
isalpha
abort
fwrite
sprintf
memmove
strrchr
isdigit
strncmp
fclose
fflush
fgets
_fileno
fopen
fputs
_get_osfhandle
strcspn
islower
toupper
tolower
_putenv
setlocale
memcpy
_stat64i32
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__C_specific_handler
__initenv
_fmode
_commode
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCaptureCurrentContext
__crtCapturePreviousContext
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
strchr
_unlink
exit
__iob_func
_strdup
_getcwd
_dclass
strcmp

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fcadefedb02feacc0bb5d2199d12bfd6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libintl-8

libpq

kernel32

advapi32

msvcr120

Sections

.text Size: 34KB - Virtual size: 33KB

.rdata Size: 24KB - Virtual size: 24KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 24KB - Virtual size: 23KB

.text
Size: 34KB - Virtual size: 33KB

.rdata
Size: 24KB - Virtual size: 24KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 24KB - Virtual size: 23KB