initdb[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

initdb.exe
Size

128KB
MD5

1c5908c57765e1325d759dfdcf490dc9
SHA1

70aead568d539cd3de49ffe94a3b9e75566c8b9c
SHA256

6273031d1f54560a2987d9c0f8df1e725f52983b800e9feba69fe1440c3c69c5
SHA512

d406958b1c271dd4c546dbb654ffc97c9717bb7e2d4ecb64de3edefde462ee9589d00687e95fad228333dc21860453096ba5b2e97c9fa6d8d880fd1f21079305
SSDEEP

3072:osON1gDSPAStssKzZfnmWlPNzQpXriN6JzAO5oZ:gvgDSPAcsFZPmWlP5QViN6JzDGZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
initdb.exe

Files

initdb.exe
.exe windows:5 windows x86 arch:x86

5ab623148fa3a96baa2e4d571ec78490

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\pginstaller.auto\postgres.windows\Release\initdb\initdb.pdb

Imports

libintl-8

libintl_textdomain
libintl_bindtextdomain
libintl_gettext

ws2_32

ntohs
htonl
gethostbyname
WSAGetLastError
htons
WSAStartup

kernel32

CreateProcessA
GetCurrentDirectoryA
FreeLibrary
GetProcAddress
GetExitCodeProcess
ResumeThread
LoadLibraryA
GetCommandLineA
GetModuleHandleA
SetEnvironmentVariableA
GetShortPathNameA
GetStdHandle
GetConsoleMode
CreatePipe
DeviceIoControl
FormatMessageA
CreateDirectoryA
RemoveDirectoryA
CreateFileA
GetFileAttributesA
GetFileAttributesExA
MoveFileExA
MultiByteToWideChar
WideCharToMultiByte
FindClose
FindFirstFileA
FindNextFileA
SleepEx
DuplicateHandle
CloseHandle
ReadFile
WaitForSingleObject
GetLastError
GetCurrentProcess
LocalFree
LocalAlloc
GetCurrentThreadId
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
QueryPerformanceCounter
GetCurrentProcessId
SetConsoleMode
GetSystemTimeAsFileTime

advapi32

GetUserNameA
FreeSid
AllocateAndInitializeSid
OpenProcessToken
AddAccessAllowedAceEx
GetAce
AddAce
GetAclInformation
InitializeAcl
GetLengthSid
SetTokenInformation
GetTokenInformation
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
CreateProcessAsUserA

msvcr120

_mkdir
__iob_func
isalnum
getenv
_localtime32
strftime
_time32
memset
fclose
ferror
fflush
fgetc
fgets
fopen
_chmod
puts
rewind
setvbuf
_errno
exit
_unlink
strtol
free
strchr
strerror
strncmp
strstr
isalpha
_commit
memcpy
malloc
memmove
fputc
_pclose
strncpy
realloc
fwrite
sprintf
strrchr
isdigit
_dclass
_putenv
abort
isupper
islower
toupper
tolower
setlocale
_stat32
_popen
system
_create_locale
_free_locale
signal
strcspn
isxdigit
isspace
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_invoke_watson
_controlfp_s
_except_handler4_common
_open
_close
_umask
_read
_strdup
_rmdir
_getcwd
fputs
atoi

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ab623148fa3a96baa2e4d571ec78490

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libintl-8

ws2_32

kernel32

advapi32

msvcr120

Sections

.text Size: 61KB - Virtual size: 60KB

.rdata Size: 41KB - Virtual size: 41KB

.data Size: 1024B - Virtual size: 51KB

.rsrc Size: 24KB - Virtual size: 23KB

.text
Size: 61KB - Virtual size: 60KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 1024B - Virtual size: 51KB

.rsrc
Size: 24KB - Virtual size: 23KB