5a21dda48f8a914b0c0b0d3a87207bf1e80ae59bd57a8d390085dc5653acbc40

Sharing

Copy URL Twitter E-mail

General

Target

5a21dda48f8a914b0c0b0d3a87207bf1e80ae59bd57a8d390085dc5653acbc40
Size

29KB
MD5

c017e752ca02e1f04354b45886194349
SHA1

c4d01ca3a6973e82124b93a3b9df83c2b15c2acb
SHA256

5a21dda48f8a914b0c0b0d3a87207bf1e80ae59bd57a8d390085dc5653acbc40
SHA512

69c9db6b55f13ac4897415d916b52d6613ccf933f211dbf2d84fe9e0576ad58411f2fd48ae665757dd6cfde8698e2499061c0ff180245a86771e091b84c19669
SSDEEP

384:H6QXHsCGdJhCHJdBEyUmbnG5IM4olTGHljRRD7jnrsgHg+k:HVsfhEdBEijM4olER17HsgA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a21dda48f8a914b0c0b0d3a87207bf1e80ae59bd57a8d390085dc5653acbc40

Files

5a21dda48f8a914b0c0b0d3a87207bf1e80ae59bd57a8d390085dc5653acbc40
.dll windows:6 windows x64 arch:x64

f3c873e6398fb0ebc7c746de86f14e7d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-14.12\Release\pg_prewarm\pg_prewarm.pdb

Imports

postgres.exe

LockBufHdr
have_free_buffer
dsm_create
dsm_attach
dsm_detach
dsm_segment_address
dsm_segment_handle
on_shmem_exit
before_shmem_exit
cancel_before_shmem_exit
GetCurrentTimestamp
TimestampDifferenceMilliseconds
procsignal_sigusr1_handler
DefineCustomBoolVariable
DefineCustomIntVariable
EmitWarningsOnPlaceholders
ProcessConfigFile
die
AllocateFile
FreeFile
durable_rename
RelidByRelfilenode
WaitForBackgroundWorkerShutdown
pg_signal_mask
error_context_stack
smgrsetowner
InterruptPending
NBuffers
MyProcPid
MyLatch
process_shared_preload_libraries_in_progress
ConfigReloadPending
ShutdownRequestPending
MainLWLockArray
BufferDescriptors
relation_open
pg_detoast_datum_packed
GetUserId
forkname_to_number
smgrread
pg_class_aclcheck
aclcheck_error
text_to_cstring
get_rel_name
get_relkind_objtype
WaitForBackgroundWorkerStartup
RegisterDynamicBackgroundWorker
RegisterBackgroundWorker
ProcessInterrupts
CommitTransactionCommand
StartTransactionCommand
relation_close
smgrexists
smgropen
RequestAddinShmemSpace
ShmemInitStruct
LWLockInitialize
LWLockRegisterTranche
LWLockNewTrancheId
LWLockRelease
LWLockAcquire
WaitLatch
ResetLatch
RelationGetNumberOfBlocksInFork
ReleaseBuffer
ReadBufferExtended
SignalHandlerForShutdownRequest
SignalHandlerForConfigReload
BackgroundWorkerUnblockSignals
PG_exception_stack
BackgroundWorkerInitializeConnectionByOid
try_relation_open
pfree
palloc
pg_re_throw
errhint
errmsg_internal
errmsg
errcode_for_file_access
errcode
errfinish
errstart
pqsignal
pg_qsort
pgunlink
pg_fprintf
pg_snprintf
pg_signal_queue
pgwin32_dispatch_queued_signals

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
__intrinsic_setjmp
memset
__current_exception
__current_exception_context
memcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfscanf

api-ms-win-crt-runtime-l1-1-0

_errno
terminate
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

strcmp

kernel32

GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

Exports

Exports

Pg_magic_func
_PG_init
__local_stdio_scanf_options
autoprewarm_database_main
autoprewarm_dump_now
autoprewarm_main
autoprewarm_start_worker
fscanf
pg_finfo_autoprewarm_dump_now
pg_finfo_autoprewarm_start_worker
pg_finfo_pg_prewarm
pg_prewarm

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3c873e6398fb0ebc7c746de86f14e7d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

postgres.exe

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 12KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 9KB

.pdata Size: 1024B - Virtual size: 1020B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 44B

.text
Size: 13KB - Virtual size: 12KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 9KB

.pdata
Size: 1024B - Virtual size: 1020B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 44B