pg_resetxlog[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

pg_resetxlog.exe
Size

75KB
MD5

8ff6086bf21f9027232f28f74c471139
SHA1

91372f3cf2ed75dd7215bbac197b11c9584ecf88
SHA256

82b19e4d7b8ee2e3a74302844d5e4871c10a86e0f4ca60b3e6a69abba59d0181
SHA512

f24635b989a1b46367ee9db1b107cfdadd961a1162645699c6f798885096c300ed70f1f310bb950af501f31200f040a6f506e9cb1f01e27cc8656c477d872d41
SSDEEP

1536:uiml21ULyzgAHAhNP3n3QvBeeLuB5oGqZ:uts1myfHsh3nmrO5oZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pg_resetxlog.exe

Files

pg_resetxlog.exe
.exe windows:5 windows x86 arch:x86

90fd486b77a003409e8cd02ec57ef89e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\pginstaller.auto\postgres.windows\Release\pg_resetxlog\pg_resetxlog.pdb

Imports

libintl-8

libintl_textdomain
libintl_gettext
libintl_bindtextdomain

kernel32

FreeLibrary
GetProcAddress
GetExitCodeProcess
ResumeThread
LoadLibraryA
GetCommandLineA
GetShortPathNameA
DeviceIoControl
FormatMessageA
CreateDirectoryA
RemoveDirectoryA
CreateFileA
GetCurrentDirectoryA
GetFileAttributesExA
MoveFileExA
MultiByteToWideChar
WideCharToMultiByte
GetSystemTimeAsFileTime
GetModuleHandleA
FindClose
FindFirstFileA
FindNextFileA
SetEnvironmentVariableA
SleepEx
CreateProcessA
CreatePipe
DuplicateHandle
CloseHandle
ReadFile
WaitForSingleObject
GetLastError
GetCurrentProcess
LocalFree
LocalAlloc
GetCurrentProcessId
GetFileAttributesA
DecodePointer
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
GetCurrentThreadId

advapi32

FreeSid
AllocateAndInitializeSid
OpenProcessToken
AddAccessAllowedAceEx
GetAce
AddAce
GetAclInformation
InitializeAcl
GetLengthSid
SetTokenInformation
GetTokenInformation
CreateProcessAsUserA

msvcr120

strtoul
strerror
strspn
_commit
_time32
exit
fputc
_pclose
getenv
free
_unlink
strncpy
isalpha
malloc
realloc
abort
strncmp
strstr
fwrite
sprintf
memmove
strrchr
isdigit
_dclass
_stat32
_putenv
isupper
islower
toupper
tolower
setlocale
memcpy
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_invoke_watson
_controlfp_s
_except_handler4_common
_strdup
_write
_errno
sscanf
puts
__iob_func
_getcwd
memset
strchr
_getpid
_chdir
_close
_open
_read

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90fd486b77a003409e8cd02ec57ef89e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libintl-8

kernel32

advapi32

msvcr120

Sections

.text Size: 30KB - Virtual size: 30KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 24KB - Virtual size: 23KB

.text
Size: 30KB - Virtual size: 30KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 24KB - Virtual size: 23KB