libmysql[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

libmysql.dll
Size

3.9MB
MD5

74a5e5fc8482af9d7fe93db6d8743a13
SHA1

90162b84e2a1b78cf1366c0ab6bac5c146397ca3
SHA256

4e03ef340f622dc8b051518e67f8d6e7c33066d6540aaef0a8d65971261495ce
SHA512

4a44e76d3f80efda3c93e2378fe77ae2ee4441d6c61f0b581ae388560e2717ebe88c5bab54fdae8966d0116da96bd2993adddf2bc99a6fa7272fba3773b24534
SSDEEP

49152:z+pRQ3/xYPd66uUmSPO54tT6BQ+Yf1jpK6fRUV:QRG/xYP/EtUtkV

Score

1^/10

Malware Config

Signatures

Files

libmysql.dll
.dll windows:6 windows x64 arch:x64

5d1d5496da75a9b84afcc5ef091928ae

Code Sign

59:7e:4e:45:cb:c1:15:bb:a6:40:26:02:e8:9c:bf:45
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

26/02/2018, 00:00

Not After

27/02/2020, 23:59

Subject

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:bd:d1:16:01:d7:aa:52:1f:9d:5f:3a:2a:da:7c:0a:3a:ee:bd:79
Signer

Actual PE Digest

09:bd:d1:16:01:d7:aa:52:1f:9d:5f:3a:2a:da:7c:0a:3a:ee:bd:79

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

G:\ade\build\sb_0-33648028-1555169098.48\release\libmysql\RelWithDebInfo\libmysql.pdb

Imports

msvcr120

_beginthreadex
_endthreadex
_findclose
_findfirst64i32
_findnext64i32
toupper
ferror
fread
fseek
ftell
fwrite
printf
putc
_umask
_strtoi64
_strtoui64
fgets
_stat64
strcspn
strstr
feof
rewind
_snprintf
??_V@YAXPEAX@Z
??_U@YAPEAX_K@Z
_gmtime64
log
pow
vfprintf
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCaptureCurrentContext
__crtCapturePreviousContext
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
_fstat64
fopen
fclose
_open_osfhandle
puts
_get_osfhandle
_close
fputs
fputc
fflush
strrchr
fprintf
strerror_s
strcat_s
signal
_set_abort_behavior
calloc
_tzset
_set_invalid_parameter_handler
__iob_func
strtok_s
strncpy
strncat
_strnicmp
realloc
qsort
strtol
memcmp
malloc
strnlen
ldiv
__CxxFrameHandler3
_CxxThrowException
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_purecall
_hypot
_time64
_localtime64_s
strcmp
strtoul
exit
_errno
strncmp
strchr
memset
memcpy
floor
getenv
atoi
sprintf
memmove
_getch
_cputs
iscntrl
isspace
_strdup
_putenv
_fdopen
_fileno
_getcwd
_chdir
_stricmp
_dup2
__clean_type_info_names_internal
__dllonexit
_onexit
_calloc_crt
_unlock
_lock
__C_specific_handler
_initterm_e
_initterm
_malloc_crt
free
_amsg_exit
putchar
__CppXcptFilter
freopen

kernel32

IsProcessorFeaturePresent
WideCharToMultiByte
MultiByteToWideChar
EncodePointer
DecodePointer
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
FindNextFileA
FindFirstFileA
FindClose
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
GetLogicalDrives
TerminateThread
GetCurrentProcess
DuplicateHandle
SetFilePointerEx
SetEndOfFile
GetFileSizeEx
GetFileAttributesExA
FlushFileBuffers
GetStdHandle
LoadLibraryA
GetFullPathNameA
GetFileAttributesA
Sleep
GetLocaleInfoA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
QueryPerformanceFrequency
WaitForMultipleObjects
CancelIo
GetOverlappedResult
PeekNamedPipe
DisconnectNamedPipe
SetLastError
WriteFile
ReadFile
CreateEventA
GetConsoleCP
WaitNamedPipeA
OpenFileMappingA
UnmapViewOfFile
MapViewOfFile
OpenEventA
CreateMutexA
WaitForSingleObject
ReleaseMutex
SetEvent
SetNamedPipeHandleState
CloseHandle
CreateFileA
FormatMessageA
LoadLibraryExA
GetProcAddress
FreeLibrary
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLastError
IsDebuggerPresent

secur32

GetUserNameExW
AcquireCredentialsHandleA
FreeCredentialsHandle
CompleteAuthToken
DeleteSecurityContext
FreeContextBuffer
InitializeSecurityContextW

msvcp120

?_Syserror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAPEBDH@Z

advapi32

IsValidSid
GetTokenInformation
EqualSid
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegOpenKeyExA
RegEnumValueA
RegCloseKey
LookupAccountNameW

ws2_32

__WSAFDIsSet
connect
ioctlsocket
getpeername
getsockopt
htonl
recv
select
freeaddrinfo
setsockopt
shutdown
WSASetLastError
WSAIoctl
getnameinfo
WSAStartup
WSACleanup
getaddrinfo
WSAGetLastError
socket
getsockname
closesocket
bind
getservbyname
send
ntohs

Exports

Exports

get_tty_password
handle_options
my_init
my_load_defaults
my_make_scrambled_password
mysql_affected_rows
mysql_autocommit
mysql_change_user
mysql_character_set_name
mysql_client_find_plugin
mysql_client_register_plugin
mysql_close
mysql_commit
mysql_data_seek
mysql_debug
mysql_dump_debug_info
mysql_eof
mysql_errno
mysql_error
mysql_escape_string
mysql_fetch_field
mysql_fetch_field_direct
mysql_fetch_fields
mysql_fetch_lengths
mysql_fetch_row
mysql_field_count
mysql_field_seek
mysql_field_tell
mysql_free_result
mysql_get_character_set_info
mysql_get_client_info
mysql_get_client_version
mysql_get_host_info
mysql_get_option
mysql_get_proto_info
mysql_get_server_info
mysql_get_server_version
mysql_get_ssl_cipher
mysql_hex_string
mysql_info
mysql_init
mysql_insert_id
mysql_kill
mysql_list_dbs
mysql_list_fields
mysql_list_processes
mysql_list_tables
mysql_load_plugin
mysql_load_plugin_v
mysql_more_results
mysql_next_result
mysql_num_fields
mysql_num_rows
mysql_options
mysql_options4
mysql_ping
mysql_plugin_options
mysql_query
mysql_read_query_result
mysql_real_connect
mysql_real_escape_string
mysql_real_escape_string_quote
mysql_real_query
mysql_refresh
mysql_reset_connection
mysql_rollback
mysql_row_seek
mysql_row_tell
mysql_select_db
mysql_send_query
mysql_server_end
mysql_server_init
mysql_session_track_get_first
mysql_session_track_get_next
mysql_set_character_set
mysql_set_local_infile_default
mysql_set_local_infile_handler
mysql_set_server_option
mysql_shutdown
mysql_sqlstate
mysql_ssl_set
mysql_stat
mysql_stmt_affected_rows
mysql_stmt_attr_get
mysql_stmt_attr_set
mysql_stmt_bind_param
mysql_stmt_bind_result
mysql_stmt_close
mysql_stmt_data_seek
mysql_stmt_errno
mysql_stmt_error
mysql_stmt_execute
mysql_stmt_fetch
mysql_stmt_fetch_column
mysql_stmt_field_count
mysql_stmt_free_result
mysql_stmt_init
mysql_stmt_insert_id
mysql_stmt_next_result
mysql_stmt_num_rows
mysql_stmt_param_count
mysql_stmt_param_metadata
mysql_stmt_prepare
mysql_stmt_reset
mysql_stmt_result_metadata
mysql_stmt_row_seek
mysql_stmt_row_tell
mysql_stmt_send_long_data
mysql_stmt_sqlstate
mysql_stmt_store_result
mysql_store_result
mysql_thread_end
mysql_thread_id
mysql_thread_init
mysql_thread_safe
mysql_use_result
mysql_warning_count

Sections

.text
Size: 540KB - Virtual size: 540KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 469KB - Virtual size: 922KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d1d5496da75a9b84afcc5ef091928ae

Code Sign

59:7e:4e:45:cb:c1:15:bb:a6:40:26:02:e8:9c:bf:45Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

09:bd:d1:16:01:d7:aa:52:1f:9d:5f:3a:2a:da:7c:0a:3a:ee:bd:79Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr120

kernel32

secur32

msvcp120

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 540KB - Virtual size: 540KB

.rdata Size: 2.9MB - Virtual size: 2.9MB

.data Size: 469KB - Virtual size: 922KB

.pdata Size: 34KB - Virtual size: 33KB

.rsrc Size: 1024B - Virtual size: 872B

.reloc Size: 12KB - Virtual size: 11KB

59:7e:4e:45:cb:c1:15:bb:a6:40:26:02:e8:9c:bf:45
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

09:bd:d1:16:01:d7:aa:52:1f:9d:5f:3a:2a:da:7c:0a:3a:ee:bd:79
Signer

.text
Size: 540KB - Virtual size: 540KB

.rdata
Size: 2.9MB - Virtual size: 2.9MB

.data
Size: 469KB - Virtual size: 922KB

.pdata
Size: 34KB - Virtual size: 33KB

.rsrc
Size: 1024B - Virtual size: 872B

.reloc
Size: 12KB - Virtual size: 11KB