libpq[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

libpq.dll
Size

3.1MB
MD5

61381b10f359dafb5a38c13f27ab2931
SHA1

9e7ca118fab0c802f796da194dd14ac778e89d95
SHA256

79975febda96fd314df792627c45ac1d00d1f4bd8e08d679f9556ace025f6bda
SHA512

ebda892627d49ae85484a861151f2333cf858cd2bdc05fb2027a58d948aa2af580981afd99206de231387ee6a0c6d38ee19a920dc0c7deb7f1667fb2c21e254d
SSDEEP

49152:IlVwASO8GtlqUHIU6iEwl3JyOuzqHXh4/vSY36YFiHXEAUV0Irb+Xla03/yP92PR:Eo+Ey5zXXA6YfHVbs/G2p

Score

1^/10

Malware Config

Signatures

Files

libpq.dll
.dll windows:5 windows x64 arch:x64

d85a077727aea98117d04b6d0ad6f8dc

Code Sign

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:be
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26/04/2021, 00:00

Not After

01/05/2024, 23:59

Subject

CN=LLC 1C-Soft,OU=LLC 1C-Soft,O=LLC 1C-Soft,L=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ae:8e:8d:1a:1d:68:8e:59:62:3d:3c:8c:5e:0d:70:08:1f:91:5f:ff:51:fe:e3:d6:da:a3:af:5e:0d:c3:94:d9
Signer

Actual PE Digest

ae:8e:8d:1a:1d:68:8e:59:62:3d:3c:8c:5e:0d:70:08:1f:91:5f:ff:51:fe:e3:d6:da:a3:af:5e:0d:c3:94:d9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Jenkins\ci_builder\PostgreSQL\postgresql\Release\libpq\libpq.pdb

Imports

secur32

FreeContextBuffer
FreeCredentialsHandle
DeleteSecurityContext
InitializeSecurityContextA
AcquireCredentialsHandleA

ws2_32

send
setsockopt
socket
WSAStartup
WSASetLastError
WSAGetLastError
WSAIoctl
select
ntohs
getaddrinfo
freeaddrinfo
getnameinfo
ioctlsocket
recv
gethostbyname
getsockopt
getsockname
connect
closesocket
WSACleanup
accept
bind
listen

crypt32

CertFindChainInStore
CertFreeCertificateChain
CertGetIntendedKeyUsage
CertVerifyTimeValidity
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

wldap32

ord13
ord35
ord36
ord26
ord22
ord41
ord88
ord51
ord143
ord79

kernel32

IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
SleepEx
GetStartupInfoW
GetModuleHandleA
GetLocaleInfoEx
GetFileInformationByHandleEx
GetFileAttributesA
CreateFileA
GetFileInformationByHandle
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
LoadLibraryW
GetLastError
FormatMessageA
GetCurrentThreadId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExA
SetLastError
GetSystemTime
SystemTimeToFileTime
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateFiber
DeleteFiber
SwitchToFiber
GetModuleHandleExW
FindClose
FindFirstFileW
FindNextFileW
MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
GetFileType
GetStdHandle
WriteFile
GetModuleHandleW
GetEnvironmentVariableW
FormatMessageW
ConvertThreadToFiber
ConvertFiberToThread
GetCurrentProcessId
GetSystemTimeAsFileTime
QueryPerformanceCounter
RtlVirtualUnwind
FreeLibrary
CloseHandle
LoadLibraryA

user32

MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation

advapi32

CryptSignHashW
GetUserNameA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptEnumProvidersW
CryptExportKey
CryptDestroyHash
CryptCreateHash
CryptDecrypt

shell32

SHGetFolderPathA

vcruntime140

memchr
strchr
memset
memcmp
memmove
strrchr
wcsstr
strstr
memcpy
__C_specific_handler
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

free
realloc
calloc
malloc

api-ms-win-crt-convert-l1-1-0

strtol
strtoul
atoi

api-ms-win-crt-string-l1-1-0

toupper
islower
isupper
isalnum
tolower
strncat
_strdup
strcspn
_strnicmp
strncmp
strcmp
_stricmp
isalpha
isxdigit
isspace
strspn
isdigit
isprint
strncpy
strnlen

api-ms-win-crt-stdio-l1-1-0

fseek
__stdio_common_vswprintf
fread
ftell
_wfopen
fopen
__stdio_common_vfprintf
_fileno
_isatty
__stdio_common_vsprintf
fwrite
_get_osfhandle
putc
_pclose
fputc
fflush
_write
_read
_open_osfhandle
_close
_popen
__acrt_iob_func
__stdio_common_vsscanf
fclose
feof
ferror
fgets
_setmode
fputs

api-ms-win-crt-runtime-l1-1-0

system
_initialize_narrow_environment
_execute_onexit_table
_crt_atexit
_initterm
_initialize_onexit_table
_wassert
strerror
_initterm_e
signal
_crt_at_quick_exit
_seh_filter_dll
_cexit
abort
strerror_s
_errno
terminate
raise
_exit
_register_onexit_function
_configure_narrow_argv

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64_s
strftime
_localtime64

api-ms-win-crt-utility-l1-1-0

bsearch
qsort

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-math-l1-1-0

_dclass
_fdopen

api-ms-win-crt-locale-l1-1-0

setlocale

Exports

Exports

PQbackendPID
PQbinaryTuples
PQcancel
PQclear
PQclientEncoding
PQcmdStatus
PQcmdTuples
PQconndefaults
PQconnectPoll
PQconnectStart
PQconnectStartParams
PQconnectdb
PQconnectdbParams
PQconnectionNeedsPassword
PQconnectionUsedPassword
PQconninfo
PQconninfoFree
PQconninfoParse
PQconsumeInput
PQcopyResult
PQdb
PQdefaultSSLKeyPassHook_OpenSSL
PQdescribePortal
PQdescribePrepared
PQdisplayTuples
PQdsplen
PQencryptPassword
PQencryptPasswordConn
PQendcopy
PQenterPipelineMode
PQenv2encoding
PQerrorMessage
PQescapeBytea
PQescapeByteaConn
PQescapeIdentifier
PQescapeLiteral
PQescapeString
PQescapeStringConn
PQexec
PQexecParams
PQexecPrepared
PQexitPipelineMode
PQfformat
PQfinish
PQfireResultCreateEvents
PQflush
PQfmod
PQfn
PQfname
PQfnumber
PQfreeCancel
PQfreeNotify
PQfreemem
PQfsize
PQftable
PQftablecol
PQftype
PQgetCancel
PQgetCopyData
PQgetResult
PQgetSSLKeyPassHook_OpenSSL
PQgetgssctx
PQgetisnull
PQgetlength
PQgetline
PQgetlineAsync
PQgetssl
PQgetvalue
PQgssEncInUse
PQhost
PQhostaddr
PQinitOpenSSL
PQinitSSL
PQinstanceData
PQisBusy
PQisnonblocking
PQisthreadsafe
PQlibVersion
PQmakeEmptyPGresult
PQmblen
PQmblenBounded
PQnfields
PQnotifies
PQnparams
PQntuples
PQoidStatus
PQoidValue
PQoptions
PQparameterStatus
PQparamtype
PQpass
PQping
PQpingParams
PQpipelineStatus
PQpipelineSync
PQport
PQprepare
PQprint
PQprintTuples
PQprotocolVersion
PQputCopyData
PQputCopyEnd
PQputline
PQputnbytes
PQregisterEventProc
PQregisterThreadLock
PQrequestCancel
PQresStatus
PQreset
PQresetPoll
PQresetStart
PQresultAlloc
PQresultErrorField
PQresultErrorMessage
PQresultInstanceData
PQresultMemorySize
PQresultSetInstanceData
PQresultStatus
PQresultVerboseErrorMessage
PQsendDescribePortal
PQsendDescribePrepared
PQsendFlushRequest
PQsendPrepare
PQsendQuery
PQsendQueryParams
PQsendQueryPrepared
PQserverVersion
PQsetClientEncoding
PQsetErrorContextVisibility
PQsetErrorVerbosity
PQsetInstanceData
PQsetNoticeProcessor
PQsetNoticeReceiver
PQsetResultAttrs
PQsetSSLKeyPassHook_OpenSSL
PQsetSingleRowMode
PQsetTraceFlags
PQsetdbLogin
PQsetnonblocking
PQsetvalue
PQsocket
PQsslAttribute
PQsslAttributeNames
PQsslInUse
PQsslStruct
PQstatus
PQtrace
PQtransactionStatus
PQtty
PQunescapeBytea
PQuntrace
PQuser
appendBinaryPQExpBuffer
appendPQExpBuffer
appendPQExpBufferChar
appendPQExpBufferStr
createPQExpBuffer
destroyPQExpBuffer
enlargePQExpBuffer
initPQExpBuffer
lo_close
lo_creat
lo_create
lo_export
lo_import
lo_import_with_oid
lo_lseek
lo_lseek64
lo_open
lo_read
lo_tell
lo_tell64
lo_truncate
lo_truncate64
lo_unlink
lo_write
pg_char_to_encoding
pg_encoding_to_char
pg_utf_mblen
pg_valid_server_encoding
pg_valid_server_encoding_id
pgresStatus
pqsignal
printfPQExpBuffer
resetPQExpBuffer
termPQExpBuffer

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 782KB - Virtual size: 781KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d85a077727aea98117d04b6d0ad6f8dc

Code Sign

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:beCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

ae:8e:8d:1a:1d:68:8e:59:62:3d:3c:8c:5e:0d:70:08:1f:91:5f:ff:51:fe:e3:d6:da:a3:af:5e:0d:c3:94:d9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

secur32

ws2_32

crypt32

wldap32

kernel32

user32

advapi32

shell32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 782KB - Virtual size: 781KB

.data Size: 23KB - Virtual size: 39KB

.pdata Size: 118KB - Virtual size: 117KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 25KB - Virtual size: 25KB

0d:65:50:75:ec:c1:01:71:b5:42:cd:05:db:d2:c7:be
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

ae:8e:8d:1a:1d:68:8e:59:62:3d:3c:8c:5e:0d:70:08:1f:91:5f:ff:51:fe:e3:d6:da:a3:af:5e:0d:c3:94:d9
Signer

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 782KB - Virtual size: 781KB

.data
Size: 23KB - Virtual size: 39KB

.pdata
Size: 118KB - Virtual size: 117KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 25KB - Virtual size: 25KB