b005219efbe2eff02feec1484869764306094edfdf0d7b9161375f039cc187a6

Sharing

Copy URL Twitter E-mail

General

Target

b005219efbe2eff02feec1484869764306094edfdf0d7b9161375f039cc187a6
Size

659KB
MD5

c70c012a6b38f2fe2a9728e26b782e81
SHA1

dcb2d69cda9829676e349660f74bc0e6fb2a2795
SHA256

b005219efbe2eff02feec1484869764306094edfdf0d7b9161375f039cc187a6
SHA512

7c7033c2b1fe8f486156cf10ff342752033e3ff559f2f9056ba0a7e106a5c451bab908790bd03d6637fe503b5202dd9b64381d48fcfdaf61d44379d88375d0e5
SSDEEP

12288:S7tJrlrlWNc1J4eKtvD5N9nylBNHdvUNUsLM5sVgI2oqXU0VXLfCF9rP4NZO9OY+:ABlBBdvxsLM5saoqe9rPYZHT/EJ2/HK4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b005219efbe2eff02feec1484869764306094edfdf0d7b9161375f039cc187a6

Files

b005219efbe2eff02feec1484869764306094edfdf0d7b9161375f039cc187a6
.dll windows:6 windows x86 arch:x86

f564fb1246324dc19b06ca65adc9a05a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\open\pg\Release\libpq\libpq.pdb

Imports

secur32

FreeCredentialsHandle
AcquireCredentialsHandleA
DeleteSecurityContext
FreeContextBuffer
InitializeSecurityContextA

ws2_32

WSAGetLastError
WSAStartup
socket
setsockopt
send
recv
getsockopt
getsockname
connect
closesocket
WSAIoctl
WSASetLastError
ioctlsocket
select
gethostbyname

wldap32

ord26
ord22
ord41
ord51
ord13
ord143
ord88
ord35
ord79
ord36

kernel32

GetTimeZoneInformation
GetStringTypeW
DeleteFileW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapSize
CreatePipe
GetFileAttributesExW
GetExitCodeProcess
WaitForSingleObject
GetFileSizeEx
SetFilePointerEx
HeapReAlloc
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetLastError
FormatMessageA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
LoadLibraryExA
FlushFileBuffers
DecodePointer
OutputDebugStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
CreateFileA
CloseHandle
MultiByteToWideChar
GetLocaleInfoEx
FreeLibrary
GetProcAddress
LoadLibraryA
CreateDirectoryA
GetFileAttributesA
GetFileAttributesExA
RemoveDirectoryA
DeviceIoControl
LocalFree
MoveFileExA
WideCharToMultiByte
SleepEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
SetLastError
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetConsoleMode
ReadConsoleW
WriteFile
GetConsoleOutputCP
DuplicateHandle
CreateProcessW
SetConsoleCtrlHandler
SetStdHandle
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ExitProcess
HeapFree
HeapAlloc
GetCurrentThread
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW

advapi32

CryptAcquireContextA
GetUserNameA
CryptGenRandom

shell32

SHGetFolderPathA

Exports

Exports

PQbackendPID
PQbinaryTuples
PQcancel
PQclear
PQclientEncoding
PQcmdStatus
PQcmdTuples
PQconndefaults
PQconnectPoll
PQconnectStart
PQconnectStartParams
PQconnectdb
PQconnectdbParams
PQconnectionNeedsPassword
PQconnectionUsedPassword
PQconninfo
PQconninfoFree
PQconninfoParse
PQconsumeInput
PQcopyResult
PQdb
PQdefaultSSLKeyPassHook_OpenSSL
PQdescribePortal
PQdescribePrepared
PQdisplayTuples
PQdsplen
PQencryptPassword
PQencryptPasswordConn
PQendcopy
PQenv2encoding
PQerrorMessage
PQescapeBytea
PQescapeByteaConn
PQescapeIdentifier
PQescapeLiteral
PQescapeString
PQescapeStringConn
PQexec
PQexecParams
PQexecPrepared
PQfformat
PQfinish
PQfireResultCreateEvents
PQflush
PQfmod
PQfn
PQfname
PQfnumber
PQfreeCancel
PQfreeNotify
PQfreemem
PQfsize
PQftable
PQftablecol
PQftype
PQgetCancel
PQgetCopyData
PQgetResult
PQgetSSLKeyPassHook_OpenSSL
PQgetgssctx
PQgetisnull
PQgetlength
PQgetline
PQgetlineAsync
PQgetssl
PQgetvalue
PQgssEncInUse
PQhost
PQhostaddr
PQinitOpenSSL
PQinitSSL
PQinstanceData
PQisBusy
PQisnonblocking
PQisthreadsafe
PQlibVersion
PQmakeEmptyPGresult
PQmblen
PQnfields
PQnotifies
PQnparams
PQntuples
PQoidStatus
PQoidValue
PQoptions
PQparameterStatus
PQparamtype
PQpass
PQping
PQpingParams
PQport
PQprepare
PQprint
PQprintTuples
PQprotocolVersion
PQputCopyData
PQputCopyEnd
PQputline
PQputnbytes
PQregisterEventProc
PQregisterThreadLock
PQrequestCancel
PQresStatus
PQreset
PQresetPoll
PQresetStart
PQresultAlloc
PQresultErrorField
PQresultErrorMessage
PQresultInstanceData
PQresultMemorySize
PQresultSetInstanceData
PQresultStatus
PQresultVerboseErrorMessage
PQsendDescribePortal
PQsendDescribePrepared
PQsendPrepare
PQsendQuery
PQsendQueryParams
PQsendQueryPrepared
PQserverVersion
PQsetClientEncoding
PQsetErrorContextVisibility
PQsetErrorVerbosity
PQsetInstanceData
PQsetNoticeProcessor
PQsetNoticeReceiver
PQsetResultAttrs
PQsetSSLKeyPassHook_OpenSSL
PQsetSingleRowMode
PQsetdbLogin
PQsetnonblocking
PQsetvalue
PQsocket
PQsslAttribute
PQsslAttributeNames
PQsslInUse
PQsslStruct
PQstatus
PQtrace
PQtransactionStatus
PQtty
PQunescapeBytea
PQuntrace
PQuser
appendBinaryPQExpBuffer
appendPQExpBuffer
appendPQExpBufferChar
appendPQExpBufferStr
createPQExpBuffer
destroyPQExpBuffer
enlargePQExpBuffer
initPQExpBuffer
lo_close
lo_creat
lo_create
lo_export
lo_import
lo_import_with_oid
lo_lseek
lo_lseek64
lo_open
lo_read
lo_tell
lo_tell64
lo_truncate
lo_truncate64
lo_unlink
lo_write
pg_char_to_encoding
pg_encoding_to_char
pg_utf_mblen
pg_valid_server_encoding
pg_valid_server_encoding_id
pgresStatus
pqsignal
printfPQExpBuffer
resetPQExpBuffer
termPQExpBuffer

Sections

.text
Size: 482KB - Virtual size: 482KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f564fb1246324dc19b06ca65adc9a05a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

secur32

ws2_32

wldap32

kernel32

advapi32

shell32

Exports

Exports

Sections

.text Size: 482KB - Virtual size: 482KB

.rdata Size: 155KB - Virtual size: 154KB

.data Size: 3KB - Virtual size: 8KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 15KB

.text
Size: 482KB - Virtual size: 482KB

.rdata
Size: 155KB - Virtual size: 154KB

.data
Size: 3KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 15KB