20c2da833c7377f7c631c1bd5593b64ec5045e33db65aad3049295633143715d

Sharing

Copy URL Twitter E-mail

General

Target

20c2da833c7377f7c631c1bd5593b64ec5045e33db65aad3049295633143715d
Size

1.4MB
MD5

6fc2da1c78d7ec5b73ec2430712173e4
SHA1

cf9c2508b4dbc3ca497bf4c00be8a602194b1d1a
SHA256

20c2da833c7377f7c631c1bd5593b64ec5045e33db65aad3049295633143715d
SHA512

98bd5fb557c1ff8c50f613cde2b25ea439e2b5ca4e9b17e05f6e1c25465b2bc599e508ca401a0bb46a05e1638e186793986418ad43ecf064afd4f36de32b1f8e
SSDEEP

24576:WESoKZpxa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WOKZDaLNiXicJFFRGNzj3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20c2da833c7377f7c631c1bd5593b64ec5045e33db65aad3049295633143715d

Files

20c2da833c7377f7c631c1bd5593b64ec5045e33db65aad3049295633143715d
.exe windows:6 windows x64 arch:x64

76eddc456981846cb849b3ea2aae3256

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\jenkins\workspace\postgresql-windows-x64-build\postgresql-15.3\Release\pg_dumpall\pg_dumpall.pdb

Imports

libpq

ord185
ord67
ord126
ord48
ord47
ord64
ord69
ord38
ord33
ord21
ord85
ord72
ord140
ord15
ord113
ord97
ord14
ord78
ord152
ord4
ord156
ord68
ord75
ord91
ord90
ord70
ord76
ord77
ord45
ord130
ord34

kernel32

GetCurrentThreadId
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetSystemTimeAsFileTime
GetModuleHandleW
GetFileType
SleepEx
LoadLibraryExA
FindNextFileA
FindFirstFileA
FindClose
WideCharToMultiByte
MultiByteToWideChar
GetStartupInfoW
GetCurrentDirectoryA
GetLastError
LocalAlloc
LocalFree
GetStdHandle
GetConsoleMode
SetConsoleMode
GetShortPathNameA
CreateFileA
CloseHandle
GetFileInformationByHandle
SetEnvironmentVariableA
FreeLibrary
GetModuleHandleExA
GetProcAddress
CreateDirectoryA
GetFileAttributesA
RemoveDirectoryA
DeviceIoControl
FormatMessageA
MoveFileExA
RtlCaptureContext

advapi32

AddAccessAllowedAceEx
GetAce
GetAclInformation
GetLengthSid
GetTokenInformation
InitializeAcl
SetTokenInformation
AddAce

vcruntime140

strrchr
memset
__std_type_info_destroy_list
memcpy
__C_specific_handler
__intrinsic_setjmp
strchr
memmove
strstr

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode
realloc

api-ms-win-crt-runtime-l1-1-0

exit
_errno
terminate
perror
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_wassert
__p___argv
system
abort
_crt_atexit
_seh_filter_dll
strerror
_seh_filter_exe
_set_app_type
_crt_at_quick_exit
__p___argc
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_configure_narrow_argv

api-ms-win-crt-string-l1-1-0

strtok
strcmp
_strdup
isalnum
isspace
strcspn
tolower
toupper
islower
strspn
isalpha
strnlen
isupper
strncmp

api-ms-win-crt-stdio-l1-1-0

_popen
_setmode
_open_osfhandle
_close
__stdio_common_vsprintf
fwrite
__p__commode
ferror
_get_osfhandle
__acrt_iob_func
_fileno
setvbuf
_commit
_pclose
fputc
_isatty
_getcwd
fgets
feof
fputs
puts
fflush
fclose
_set_fmode

api-ms-win-crt-convert-l1-1-0

strtoul
strtol

api-ms-win-crt-time-l1-1-0

_localtime64
_time64
strftime

api-ms-win-crt-environment-l1-1-0

_putenv
getenv

api-ms-win-crt-math-l1-1-0

_dclass
__setusermatherr
_fdopen

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_unlink

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.2MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

76eddc456981846cb849b3ea2aae3256

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libpq

kernel32

advapi32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Sections

.text Size: 63KB - Virtual size: 63KB

.rdata Size: 41KB - Virtual size: 41KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 1.2MB - Virtual size: 1.9MB

.text
Size: 63KB - Virtual size: 63KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1.2MB - Virtual size: 1.9MB