pg_regress_ecpg[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

pg_regress_ecpg.exe
Size

81KB
MD5

6db40b80997f5e4a969309de1072b03b
SHA1

137473dd47b903b2e290175dd6b6953e07bec3d4
SHA256

bac2ba97aa6d3cc3124f624b29f00d14b7b7d0db5fb146c2859c60db72bca75b
SHA512

9da1113b716c6239be293139d8c4fbd9e2f70956319de05d73d613892e9d782060eee2c9c80a23f85b2855b94c85942c45fd5328c9cbfb3db18ffd8df8150b46
SSDEEP

1536:pQCE+yx8XEQQ0wIYip9ev6J70xI6eeLuB5oGqZ:pE8rQ0vv9g6JriO5oZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pg_regress_ecpg.exe

Files

pg_regress_ecpg.exe
.exe windows:5 windows x86 arch:x86

4f5b7364a7cc2b1bb4de5629a1d804b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\pginstaller.auto\postgres.windows\Release\pg_regress_ecpg\pg_regress_ecpg.pdb

Imports

libintl-8

libintl_textdomain
libintl_gettext
libintl_bindtextdomain

ws2_32

getaddrinfo
WSAStartup

kernel32

DuplicateHandle
CreatePipe
CreateProcessA
GetCurrentDirectoryA
FreeLibrary
GetProcAddress
ResumeThread
LoadLibraryA
GetCommandLineA
GetModuleHandleA
SetEnvironmentVariableA
GetShortPathNameA
SleepEx
ReadFile
FormatMessageA
CreateDirectoryA
RemoveDirectoryA
CreateFileA
GetFileAttributesA
GetFileAttributesExA
MoveFileExA
MultiByteToWideChar
WideCharToMultiByte
FindClose
FindFirstFileA
FindNextFileA
LocalFree
LocalAlloc
CloseHandle
WaitForMultipleObjects
WaitForSingleObject
GetLastError
GetExitCodeProcess
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
DeviceIoControl
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
QueryPerformanceCounter

advapi32

CreateProcessAsUserA
FreeSid
AllocateAndInitializeSid
AddAccessAllowedAceEx
GetAce
AddAce
GetAclInformation
InitializeAcl
GetLengthSid
SetTokenInformation
LookupAccountSidA
GetTokenInformation
OpenProcessToken
GetUserNameA

msvcr120

fopen
fputs
exit
free
malloc
strchr
strncpy
strstr
fflush
fgets
fseek
ftell
putchar
_unlink
_errno
_exit
atoi
getenv
strerror
strncmp
strrchr
strtok
isspace
memcpy
memset
fputc
_pclose
isalpha
realloc
fwrite
sprintf
memmove
isdigit
_dclass
_putenv
abort
_stat32
_popen
system
strcspn
isupper
islower
toupper
tolower
setlocale
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
_except_handler4_common
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
fclose
__iob_func
_strdup
_mkdir
_rmdir
_getcwd
fgetc
puts

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f5b7364a7cc2b1bb4de5629a1d804b9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libintl-8

ws2_32

kernel32

advapi32

msvcr120

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 1024B - Virtual size: 4KB

.rsrc Size: 24KB - Virtual size: 23KB

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 1024B - Virtual size: 4KB

.rsrc
Size: 24KB - Virtual size: 23KB