d1c54edd5b3c4f2bed003181c5256d1b474f79deb0966439493612f3bfb1d481

Sharing

Copy URL Twitter E-mail

General

Target

d1c54edd5b3c4f2bed003181c5256d1b474f79deb0966439493612f3bfb1d481
Size

15KB
MD5

6219cb7a9d2947905038317249fd0efb
SHA1

0e79f24c45f5362a2bb7f75dcfa76f42c4a9f315
SHA256

d1c54edd5b3c4f2bed003181c5256d1b474f79deb0966439493612f3bfb1d481
SHA512

52a27beecdedc4f586624f1f1417bb0df5e17aadcde4ba25f3fb83381271d27038a5e55859456f3a82f4761775de0e802bec482aaee70922846e2e16da77cd40
SSDEEP

192:KQCuLQkHKmU3Uge3MEPRjuY+n7y2fc4zNflT+knYQ:K6CyfPRjuTRVzNflykYQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1c54edd5b3c4f2bed003181c5256d1b474f79deb0966439493612f3bfb1d481

Files

d1c54edd5b3c4f2bed003181c5256d1b474f79deb0966439493612f3bfb1d481
.dll windows:6 windows x64 arch:x64

09f61b512c6d3fd7acd953d7c0ada760

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-14.11\Release\ssl_passphrase_func\ssl_passphrase_func.pdb

Imports

libssl-1_1-x64

SSL_CTX_set_default_passwd_cb

postgres.exe

DefineCustomStringVariable
openssl_tls_init_hook
ssl_passphrase_command
errfinish
errstart
strlcpy
errmsg

vcruntime140

memcpy
__current_exception
__C_specific_handler
__current_exception_context
__std_type_info_destroy_list
memset

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
terminate
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm
_register_onexit_function
_initterm_e

kernel32

InitializeSListHead
QueryPerformanceCounter
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
GetCurrentProcessId
RtlCaptureContext
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls

Exports

Exports

Pg_magic_func
_PG_fini
_PG_init

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

09f61b512c6d3fd7acd953d7c0ada760

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libssl-1_1-x64

postgres.exe

vcruntime140

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 216B

.pdata Size: 1024B - Virtual size: 576B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 40B

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 216B

.pdata
Size: 1024B - Virtual size: 576B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 40B