pg_ctl[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

pg_ctl.exe
Size

79KB
MD5

76d8fbf485398020d45af62ae3520bfb
SHA1

6664555ddccf081d62b7bdf9b19d0fbec74051b1
SHA256

7ad7b7a3239cb22743307f50d00b943a2f6f02284f0ad6607ae1e656789f579a
SHA512

4d2eb6e09a6516d2a2d714c979a930cf151fa959ffea1492408809ff206963850e7220facd95b09dbc582c27dd7e7bb696e50d788d5e0d11d4bfa80e6f8164f0
SSDEEP

1536:65ng0bFrLd4BqsevXMr9B2KY6JKAuYGeeLuB5oGqZ:sXb5LdIqmRB2f6JZeO5oZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pg_ctl.exe

Files

pg_ctl.exe
.exe windows:5 windows x86 arch:x86

59e0b40a90b6bcf173325d781db91ca2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\pginstaller.auto\postgres.windows\Release\pg_ctl\pg_ctl.pdb

Imports

libintl-8

libintl_textdomain
libintl_gettext
libintl_bindtextdomain

libpq

ord158
ord91
ord77

kernel32

CreatePipe
GetCurrentDirectoryA
GetModuleHandleA
SetEnvironmentVariableA
GetShortPathNameA
SleepEx
OpenProcess
TerminateProcess
CallNamedPipeA
DuplicateHandle
FormatMessageA
CreateDirectoryA
RemoveDirectoryA
CreateFileA
GetFileAttributesA
GetFileAttributesExA
MoveFileExA
MultiByteToWideChar
WideCharToMultiByte
ReadFile
LocalFree
LocalAlloc
VerifyVersionInfoW
CreateProcessA
LoadLibraryA
CreateEventA
CloseHandle
WaitForMultipleObjects
WaitForSingleObject
SetEvent
ResumeThread
GetLastError
GetCurrentProcess
GetProcAddress
FreeLibrary
VerSetConditionMask
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
DeviceIoControl
DecodePointer
EncodePointer
GetSystemTimeAsFileTime

advapi32

AddAccessAllowedAceEx
GetAce
AddAce
GetAclInformation
InitializeAcl
GetLengthSid
SetTokenInformation
GetTokenInformation
StartServiceCtrlDispatcherA
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
CloseServiceHandle
CreateProcessAsUserA
FreeSid
AllocateAndInitializeSid
OpenProcessToken
ReportEventA
RegisterEventSourceA
EqualSid

msvcr120

fputs
fscanf
fclose
_pclose
puts
setvbuf
_unlink
exit
atoi
atol
getenv
free
strchr
strcspn
strerror
strstr
_fstat32
_time32
memcpy
memset
fputc
strncpy
isalpha
malloc
realloc
_putenv
abort
strncmp
isupper
islower
toupper
tolower
fwrite
sprintf
memmove
fopen
isdigit
_dclass
_stat32
_popen
system
setlocale
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_invoke_watson
_controlfp_s
_except_handler4_common
_strdup
_umask
__iob_func
fgets
fflush
strrchr
feof
_getcwd
ftell
_errno
_getpid
_close
_open
_read

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

59e0b40a90b6bcf173325d781db91ca2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libintl-8

libpq

kernel32

advapi32

msvcr120

Sections

.text Size: 39KB - Virtual size: 38KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 512B - Virtual size: 7KB

.rsrc Size: 24KB - Virtual size: 23KB

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 512B - Virtual size: 7KB

.rsrc
Size: 24KB - Virtual size: 23KB