fd6bb05145a204ec8bd2bc5db35761e0c243dcb2d33212288d65a0729fedaa83

Sharing

Copy URL Twitter E-mail

General

Target

fd6bb05145a204ec8bd2bc5db35761e0c243dcb2d33212288d65a0729fedaa83
Size

659KB
MD5

173bf1d3df8694039e7e1fac2616e5b6
SHA1

dd6485eb9be80d828865a0e0c0b65b4151feedfb
SHA256

fd6bb05145a204ec8bd2bc5db35761e0c243dcb2d33212288d65a0729fedaa83
SHA512

a6fa30223c66fc3c9b077634978a6e15f607977f23aac3167e064e7a02463458d0285e1d44e1c520cdd65a8adf257a7fbafac6fee22b19db00ad33223fcca11c
SSDEEP

12288:y7tJrlrlWNc1J4eKtvD5N9nylBNHdvUNUsLM5sVgI2oqXU0VXLfCF9rP4NZO9OY+:gBlBBdvxsLM5saoqe9rPYZHT/EJ2/HK4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd6bb05145a204ec8bd2bc5db35761e0c243dcb2d33212288d65a0729fedaa83

Files

fd6bb05145a204ec8bd2bc5db35761e0c243dcb2d33212288d65a0729fedaa83
.dll windows:6 windows x86 arch:x86

f564fb1246324dc19b06ca65adc9a05a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\open\pg\Release\libpq\libpq.pdb

Imports

secur32

FreeCredentialsHandle
AcquireCredentialsHandleA
DeleteSecurityContext
FreeContextBuffer
InitializeSecurityContextA

ws2_32

WSAGetLastError
WSAStartup
socket
setsockopt
send
recv
getsockopt
getsockname
connect
closesocket
WSAIoctl
WSASetLastError
ioctlsocket
select
gethostbyname

wldap32

ord26
ord22
ord41
ord51
ord13
ord143
ord88
ord35
ord79
ord36

kernel32

GetTimeZoneInformation
GetStringTypeW
DeleteFileW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapSize
CreatePipe
GetFileAttributesExW
GetExitCodeProcess
WaitForSingleObject
GetFileSizeEx
SetFilePointerEx
HeapReAlloc
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetLastError
FormatMessageA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
LoadLibraryExA
FlushFileBuffers
DecodePointer
OutputDebugStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
CreateFileA
CloseHandle
MultiByteToWideChar
GetLocaleInfoEx
FreeLibrary
GetProcAddress
LoadLibraryA
CreateDirectoryA
GetFileAttributesA
GetFileAttributesExA
RemoveDirectoryA
DeviceIoControl
LocalFree
MoveFileExA
WideCharToMultiByte
SleepEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
SetLastError
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetConsoleMode
ReadConsoleW
WriteFile
GetConsoleOutputCP
DuplicateHandle
CreateProcessW
SetConsoleCtrlHandler
SetStdHandle
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ExitProcess
HeapFree
HeapAlloc
GetCurrentThread
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW

advapi32

CryptAcquireContextA
GetUserNameA
CryptGenRandom

shell32

SHGetFolderPathA

Exports

Exports

PQbackendPID
PQbinaryTuples
PQcancel
PQclear
PQclientEncoding
PQcmdStatus
PQcmdTuples
PQconndefaults
PQconnectPoll
PQconnectStart
PQconnectStartParams
PQconnectdb
PQconnectdbParams
PQconnectionNeedsPassword
PQconnectionUsedPassword
PQconninfo
PQconninfoFree
PQconninfoParse
PQconsumeInput
PQcopyResult
PQdb
PQdefaultSSLKeyPassHook_OpenSSL
PQdescribePortal
PQdescribePrepared
PQdisplayTuples
PQdsplen
PQencryptPassword
PQencryptPasswordConn
PQendcopy
PQenv2encoding
PQerrorMessage
PQescapeBytea
PQescapeByteaConn
PQescapeIdentifier
PQescapeLiteral
PQescapeString
PQescapeStringConn
PQexec
PQexecParams
PQexecPrepared
PQfformat
PQfinish
PQfireResultCreateEvents
PQflush
PQfmod
PQfn
PQfname
PQfnumber
PQfreeCancel
PQfreeNotify
PQfreemem
PQfsize
PQftable
PQftablecol
PQftype
PQgetCancel
PQgetCopyData
PQgetResult
PQgetSSLKeyPassHook_OpenSSL
PQgetgssctx
PQgetisnull
PQgetlength
PQgetline
PQgetlineAsync
PQgetssl
PQgetvalue
PQgssEncInUse
PQhost
PQhostaddr
PQinitOpenSSL
PQinitSSL
PQinstanceData
PQisBusy
PQisnonblocking
PQisthreadsafe
PQlibVersion
PQmakeEmptyPGresult
PQmblen
PQnfields
PQnotifies
PQnparams
PQntuples
PQoidStatus
PQoidValue
PQoptions
PQparameterStatus
PQparamtype
PQpass
PQping
PQpingParams
PQport
PQprepare
PQprint
PQprintTuples
PQprotocolVersion
PQputCopyData
PQputCopyEnd
PQputline
PQputnbytes
PQregisterEventProc
PQregisterThreadLock
PQrequestCancel
PQresStatus
PQreset
PQresetPoll
PQresetStart
PQresultAlloc
PQresultErrorField
PQresultErrorMessage
PQresultInstanceData
PQresultMemorySize
PQresultSetInstanceData
PQresultStatus
PQresultVerboseErrorMessage
PQsendDescribePortal
PQsendDescribePrepared
PQsendPrepare
PQsendQuery
PQsendQueryParams
PQsendQueryPrepared
PQserverVersion
PQsetClientEncoding
PQsetErrorContextVisibility
PQsetErrorVerbosity
PQsetInstanceData
PQsetNoticeProcessor
PQsetNoticeReceiver
PQsetResultAttrs
PQsetSSLKeyPassHook_OpenSSL
PQsetSingleRowMode
PQsetdbLogin
PQsetnonblocking
PQsetvalue
PQsocket
PQsslAttribute
PQsslAttributeNames
PQsslInUse
PQsslStruct
PQstatus
PQtrace
PQtransactionStatus
PQtty
PQunescapeBytea
PQuntrace
PQuser
appendBinaryPQExpBuffer
appendPQExpBuffer
appendPQExpBufferChar
appendPQExpBufferStr
createPQExpBuffer
destroyPQExpBuffer
enlargePQExpBuffer
initPQExpBuffer
lo_close
lo_creat
lo_create
lo_export
lo_import
lo_import_with_oid
lo_lseek
lo_lseek64
lo_open
lo_read
lo_tell
lo_tell64
lo_truncate
lo_truncate64
lo_unlink
lo_write
pg_char_to_encoding
pg_encoding_to_char
pg_utf_mblen
pg_valid_server_encoding
pg_valid_server_encoding_id
pgresStatus
pqsignal
printfPQExpBuffer
resetPQExpBuffer
termPQExpBuffer

Sections

.text
Size: 482KB - Virtual size: 482KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f564fb1246324dc19b06ca65adc9a05a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

secur32

ws2_32

wldap32

kernel32

advapi32

shell32

Exports

Exports

Sections

.text Size: 482KB - Virtual size: 482KB

.rdata Size: 155KB - Virtual size: 154KB

.data Size: 3KB - Virtual size: 8KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 15KB

.text
Size: 482KB - Virtual size: 482KB

.rdata
Size: 155KB - Virtual size: 154KB

.data
Size: 3KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 15KB