libmysql[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

libmysql.dll
Size

2.5MB
MD5

5119c5340ed5a01968fadef1eb857abd
SHA1

5788390de1389a720078c5279f5d74e2e5a83b65
SHA256

84f00bddd807b5f2dc6a9369d53b8b0a77c2d34604c612ae8b1425608f5c7c7d
SHA512

c246dc4992a34525735a9d89c7159a3b417c46ca646df038d092d421925c074706d5bba29f525d207ffe516dc33e8ad6017774fe142902e55b8bfd804832ec3f
SSDEEP

49152:ol6Nm1oSW15ahdJiH+PYT/teft4cQRJD:U+Rg6IOx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libmysql.dll

Files

libmysql.dll
.dll windows:4 windows x86 arch:x86

225a1b91d42caa4930c70cf96d77d536

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\build\mysql-5.0.41-winbuild\mysql-community-debug-5.0.41-build\libmysql\Debug\libmysql.pdb

Imports

kernel32

GetLastError
CreateFileA
UnmapViewOfFile
WaitForSingleObject
SetEvent
MapViewOfFile
OpenFileMappingA
OpenEventA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
GetTempFileNameA
GetFileAttributesExA
SetEndOfFile
SetFilePointer
WaitNamedPipeA
MoveFileA
GetTickCount
Sleep
TlsAlloc
TlsFree
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
CreateEventA
ResetEvent
WaitForMultipleObjects
SetThreadPriority
ReadFile
WriteFile
PeekNamedPipe
GetFileInformationByHandle
SetNamedPipeHandleState
CloseHandle
GetLocaleInfoA
EnterCriticalSection
SetCurrentDirectoryA
GetDriveTypeA
GetFullPathNameA
GetCurrentDirectoryA
LeaveCriticalSection
DeleteFileA
GetCurrentThreadId
GetLocaleInfoW
LCMapStringW
LCMapStringA
FreeLibrary
GetProcessHeap
SetEnvironmentVariableA
GetOEMCP
GetACP
CompareStringW
CompareStringA
InterlockedExchange
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FindClose
FindNextFileA
FindFirstFileA
QueryPerformanceCounter
QueryPerformanceFrequency
ExitProcess
TerminateProcess
GetCurrentProcess
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
WriteConsoleA
SetConsoleCtrlHandler
GetFileAttributesA
SetStdHandle
GetFileType
WideCharToMultiByte
GetTimeZoneInformation
FileTimeToSystemTime
FileTimeToLocalFileTime
IsBadWritePtr
IsBadReadPtr
HeapValidate
ResumeThread
CreateThread
ExitThread
GetCommandLineA
GetVersionExA
RtlUnwind
FatalAppExitA
DebugBreak
RaiseException
LoadLibraryA
GetCurrentProcessId
SetLastError
GetCurrentThread
GetStdHandle
InterlockedDecrement
OutputDebugStringA
SetHandleCount
GetStartupInfoA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
UnhandledExceptionFilter
FlushFileBuffers
GetTimeFormatA
GetDateFormatA
GetCPInfo
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
IsValidLocale
IsValidCodePage
EnumSystemLocalesA
GetUserDefaultLCID
HeapAlloc
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
VirtualFree
FreeEnvironmentStringsA
SetEnvironmentVariableW

user32

MessageBoxA

advapi32

CryptAcquireContextA
CryptGenRandom
RegOpenKeyExA
RegEnumValueA
RegCloseKey
CryptReleaseContext

wsock32

closesocket
setsockopt
send
recv
inet_ntoa
select
__WSAFDIsSet
inet_addr
WSAStartup
shutdown
gethostbyname
getservbyname
ntohs
socket
WSASetLastError
ioctlsocket
htons
WSAGetLastError
connect
getpeername
WSACleanup

Exports

Exports

_dig_vec_lower
_dig_vec_upper
bmove_upp
client_errors
delete_dynamic
free_defaults
get_defaults_options
getopt_compare_strings
getopt_ull_limit_value
handle_options
init_dynamic_array
insert_dynamic
int2str
is_prefix
list_add
list_delete
load_defaults
modify_defaults_file
my_end
my_getopt_print_errors
my_init
my_malloc
my_memdup
my_no_flags_free
my_path
my_print_help
my_print_variables
my_realloc
my_strdup
myodbc_remove_escape
mysql_affected_rows
mysql_autocommit
mysql_change_user
mysql_character_set_name
mysql_close
mysql_commit
mysql_data_seek
mysql_debug
mysql_disable_reads_from_master
mysql_disable_rpl_parse
mysql_dump_debug_info
mysql_embedded
mysql_enable_reads_from_master
mysql_enable_rpl_parse
mysql_eof
mysql_errno
mysql_error
mysql_escape_string
mysql_fetch_field
mysql_fetch_field_direct
mysql_fetch_fields
mysql_fetch_lengths
mysql_fetch_row
mysql_field_count
mysql_field_seek
mysql_field_tell
mysql_free_result
mysql_get_character_set_info
mysql_get_client_info
mysql_get_client_version
mysql_get_host_info
mysql_get_parameters
mysql_get_proto_info
mysql_get_server_info
mysql_get_server_version
mysql_get_ssl_cipher
mysql_hex_string
mysql_info
mysql_init
mysql_insert_id
mysql_kill
mysql_list_dbs
mysql_list_fields
mysql_list_processes
mysql_list_tables
mysql_master_query
mysql_more_results
mysql_next_result
mysql_num_fields
mysql_num_rows
mysql_odbc_escape_string
mysql_options
mysql_ping
mysql_query
mysql_read_query_result
mysql_real_connect
mysql_real_escape_string
mysql_real_query
mysql_refresh
mysql_rollback
mysql_row_seek
mysql_row_tell
mysql_rpl_parse_enabled
mysql_rpl_probe
mysql_rpl_query_type
mysql_select_db
mysql_send_query
mysql_server_end
mysql_server_init
mysql_set_character_set
mysql_set_local_infile_default
mysql_set_local_infile_handler
mysql_set_server_option
mysql_shutdown
mysql_slave_query
mysql_sqlstate
mysql_ssl_set
mysql_stat
mysql_stmt_affected_rows
mysql_stmt_attr_get
mysql_stmt_attr_set
mysql_stmt_bind_param
mysql_stmt_bind_result
mysql_stmt_close
mysql_stmt_data_seek
mysql_stmt_errno
mysql_stmt_error
mysql_stmt_execute
mysql_stmt_fetch
mysql_stmt_fetch_column
mysql_stmt_field_count
mysql_stmt_free_result
mysql_stmt_init
mysql_stmt_insert_id
mysql_stmt_num_rows
mysql_stmt_param_count
mysql_stmt_param_metadata
mysql_stmt_prepare
mysql_stmt_reset
mysql_stmt_result_metadata
mysql_stmt_row_seek
mysql_stmt_row_tell
mysql_stmt_send_long_data
mysql_stmt_sqlstate
mysql_stmt_store_result
mysql_store_result
mysql_thread_end
mysql_thread_id
mysql_thread_init
mysql_thread_safe
mysql_use_result
mysql_warning_count
set_dynamic
strcend
strcont
strdup_root
strfill
strinstr
strmake
strmov
strxmov

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

225a1b91d42caa4930c70cf96d77d536

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

wsock32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 112KB - Virtual size: 108KB

.data Size: 1.2MB - Virtual size: 1.3MB

.idata Size: 8KB - Virtual size: 4KB

.reloc Size: 48KB - Virtual size: 45KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 112KB - Virtual size: 108KB

.data
Size: 1.2MB - Virtual size: 1.3MB

.idata
Size: 8KB - Virtual size: 4KB

.reloc
Size: 48KB - Virtual size: 45KB