367f8f17ca1ca78dec101bb41f762abb_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

367f8f17ca1ca78dec101bb41f762abb_JaffaCakes118
Size

514KB
MD5

367f8f17ca1ca78dec101bb41f762abb
SHA1

629fedc1b143ebcac0d2bab844cafa7abdd520f4
SHA256

e7aa1bed9d02e224cef2358afa7de79401d0ec311c40205cfd95aa70e41df218
SHA512

330328320dd1c8f20f9b3ddfe33400aa9a89e945e52ef0f0d9a1ef3fb33165b94084a411821a1b0819ba02691c516f922cd42ca81686d1a95f26e1be1992cd37
SSDEEP

12288:tJIrDEV6ZnmOZWPUYGcgbJe49wPNu1suQf0+0InFqC/HpVvZ8xE:ovEoZmOYPU9RbJegEUZQf09IcmCxE

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/HSCAN/libmySQL.dll
unpack001/HSCAN/oncrpc.dll
unpack001/HSCAN/tools/NTCmd.exe
unpack001/HSCAN/tools/Sqlcmd.exe
unpack001/HSCAN/tools/cygwinb19.dll
unpack001/HSCAN/tools/mysql.exe

Files

367f8f17ca1ca78dec101bb41f762abb_JaffaCakes118
.rar
HSCAN/Readme.txt
HSCAN/conf/common.cgi
HSCAN/conf/ftp_pass.dic
HSCAN/conf/ftp_user.dic
HSCAN/conf/imap_pass.dic
HSCAN/conf/imap_user.dic
HSCAN/conf/ipc_pass.dic
HSCAN/conf/ipc_user.dic
HSCAN/conf/mssql_pass.dic
HSCAN/conf/mssql_user.dic
HSCAN/conf/mysql_pass.dic
HSCAN/conf/mysql_user.dic
HSCAN/conf/nt.cgi
HSCAN/conf/pop_pass.dic
HSCAN/conf/pop_user.dic
HSCAN/conf/rpc.lst
HSCAN/conf/telnet_pass.dic
HSCAN/conf/telnet_user.dic
HSCAN/conf/unix.cgi
HSCAN/hscanconf.ini
HSCAN/libmySQL.dll
.dll windows:4 windows x86 arch:x86

006c49710d9884ca7c15f8d95eeb51d4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

getservbyname
ntohs
WSAGetLastError
htons
ioctlsocket
closesocket
shutdown
recv
setsockopt
send
WSACleanup
WSAStartup
socket
gethostbyname
connect

kernel32

GetFullPathNameA
SetEnvironmentVariableW
GetLocaleInfoW
SetEndOfFile
SetEnvironmentVariableA
GetOEMCP
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetWindowsDirectoryA
GetCurrentThreadId
CloseHandle
SetNamedPipeHandleState
WaitNamedPipeA
CreateFileA
GetLastError
InterlockedIncrement
DeleteCriticalSection
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
CreateSemaphoreA
InterlockedDecrement
Sleep
ReadFile
WriteFile
HeapDestroy
HeapCreate
CompareStringW
CompareStringA
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc
GetFileType
GetStartupInfoA
LoadLibraryA
GetCommandLineA
GetVersion
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
LCMapStringW
GetACP
VirtualFree
VirtualAlloc
RtlUnwind
SetHandleCount
GetStdHandle
IsValidCodePage
GetLocaleInfoA
SetLastError
FlushFileBuffers
SetStdHandle
WideCharToMultiByte
LCMapStringA
GetCurrentDirectoryA
SetFilePointer
GetCPInfo
IsValidLocale
GetProcAddress
EnumSystemLocalesA
GetUserDefaultLCID
RaiseException
GetDriveTypeA
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetEnvironmentStringsW

advapi32

RegOpenKeyExA
RegEnumValueA
RegCloseKey

Exports

Exports

_dig_vec
bmove_upp
delete_dynamic
init_dynamic_array
insert_dynamic
int2str
is_prefix
list_add
list_delete
max_allowed_packet
my_casecmp
my_end
my_init
my_malloc
my_memdup
my_no_flags_free
my_realloc
my_strdup
my_thread_end
my_thread_init
myodbc_remove_escape
mysql_affected_rows
mysql_change_user
mysql_character_set_name
mysql_close
mysql_connect
mysql_create_db
mysql_data_seek
mysql_debug
mysql_drop_db
mysql_dump_debug_info
mysql_eof
mysql_errno
mysql_error
mysql_escape_string
mysql_fetch_field
mysql_fetch_field_direct
mysql_fetch_fields
mysql_fetch_lengths
mysql_fetch_row
mysql_field_count
mysql_field_seek
mysql_field_tell
mysql_free_result
mysql_get_client_info
mysql_get_host_info
mysql_get_proto_info
mysql_get_server_info
mysql_info
mysql_init
mysql_insert_id
mysql_kill
mysql_list_dbs
mysql_list_fields
mysql_list_processes
mysql_list_tables
mysql_num_fields
mysql_num_rows
mysql_odbc_escape_string
mysql_options
mysql_ping
mysql_query
mysql_read_query_result
mysql_real_connect
mysql_real_escape_string
mysql_real_query
mysql_refresh
mysql_row_seek
mysql_row_tell
mysql_select_db
mysql_send_query
mysql_shutdown
mysql_stat
mysql_store_result
mysql_thread_id
mysql_thread_safe
mysql_use_result
net_buffer_length
set_dynamic
strcend
strdup_root
strfill
strinstr
strmake
strmov
strxmov

Sections

.text
Size: 112KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 88KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
HSCAN/oncrpc.dll
.dll windows:1 windows x86 arch:x86

2125b46849b9f195b9b037623de522f2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

SetConsoleCtrlHandler
VirtualFree
GetFileType
GlobalMemoryStatus
GetCurrentProcessId
WriteFile
ExitProcess
RtlUnwind
GetFileAttributesA
GetEnvironmentStrings
GetCurrentThreadId
GetStdHandle
CloseHandle
GetModuleHandleA
GetLocalTime
GetModuleFileNameA
GetCommandLineA
SetFilePointer
CreateFileA
RaiseException
LeaveCriticalSection
InitializeCriticalSection
DeleteFileA
GetVersion
GetTimeZoneInformation
ReadFile
GetLastError
GetStartupInfoA
GetProcAddress
EnterCriticalSection
SetHandleCount
UnhandledExceptionFilter
VirtualAlloc

wsock32

socket
setsockopt
send
select
recvfrom
ntohs
ntohl
listen
ioctlsocket
htons
htonl
getsockname
getprotobyname
gethostname
gethostbyname
connect
closesocket
bind
accept
__WSAFDIsSet
recv
WSAStartup
WSAGetLastError
WSACleanup
sendto

advapi32

ReportEventA
DeregisterEventSource
RegisterEventSourceA

user32

MessageBoxA
EnumThreadWindows

Exports

Exports

@__lockDebuggerData$qv
@__unlockDebuggerData$qv
__DebuggerHookData
_null_auth
authnone_create
authunix_create
authunix_create_default
bcmp
bcopy
bzero
clnt_broadcast
clnt_create
clnt_pcreateerror
clnt_perrno
clnt_perror
clnt_spcreateerror
clnt_sperrno
clnt_sperror
clntraw_create
clnttcp_create
clntudp_bufcreate
clntudp_create
get_myaddress
getrpcbyname
getrpcbynumber
pmap_getmaps
pmap_getport
pmap_set
pmap_unset
rpc_createerr
rpc_nt_exit
rpc_nt_init
svc_fdset
svc_getreq
svc_getreqset
svc_register
svc_run
svc_sendreply
svc_unregister
svcerr_auth
svcerr_decode
svcerr_noproc
svcerr_noprog
svcerr_progvers
svcerr_systemerr
svcerr_weakauth
svcraw_create
svctcp_create
svcudp_bufcreate
svcudp_create
xdr_array
xdr_authunix_parms
xdr_bool
xdr_bytes
xdr_callhdr
xdr_callmsg
xdr_char
xdr_des_block
xdr_double
xdr_enum
xdr_float
xdr_free
xdr_int
xdr_long
xdr_netobj
xdr_opaque
xdr_opaque_auth
xdr_pmap
xdr_pmaplist
xdr_pointer
xdr_reference
xdr_replymsg
xdr_short
xdr_string
xdr_u_char
xdr_u_int
xdr_u_long
xdr_u_short
xdr_union
xdr_vector
xdr_void
xdr_wrapstring
xdrmem_create
xdrrec_create
xdrrec_endofrecord
xdrrec_eof
xdrrec_skiprecord
xdrstdio_create
xprt_register
xprt_unregister

Sections

CODE
Size: 49KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
HSCAN/plugin/fpe2k.hsp
HSCAN/plugin/luenum.hsp
HSCAN/plugin/qpop.hsp
HSCAN/plugin/sunftp.hsp
HSCAN/tools/NTCmd.exe
.exe windows:4 windows x86 arch:x86

73767e539e9720aff83d4da1db391803

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapCreate
DuplicateHandle
GetCurrentProcess
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetLastError
SetStdHandle
GetFileType
SetHandleCount
GetStdHandle
GetStartupInfoA
CreatePipe
GetExitCodeProcess
WaitForSingleObject
HeapReAlloc
HeapAlloc
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
CloseHandle
VirtualFree
HeapFree
RtlUnwind
WriteFile
VirtualAlloc
ReadFile
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
FlushFileBuffers
GetFileAttributesA
CreateProcessA
MultiByteToWideChar
CompareStringA
CompareStringW
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
HSCAN/tools/Sqlcmd.exe
.exe windows:4 windows x86 arch:x86

794cb112594371ed14da81bc0592ca2a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

odbc32

ord24
ord3
ord75
ord41
ord43
ord11
ord13

kernel32

FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetStringTypeW
GetStringTypeA
CloseHandle
LoadLibraryA
SetStdHandle
GetCommandLineA
GetVersion
ExitProcess
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
HeapReAlloc
VirtualAlloc
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
GetOEMCP
GetProcAddress
GetLastError
ReadFile
FlushFileBuffers
SetFilePointer
GetCPInfo
GetACP

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
HSCAN/tools/cygwinb19.dll
.dll windows:4 windows x86 arch:x86

0f068abeaa3b9ee1380205dbc1e98308

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

AdjustTokenPrivileges
IsValidSecurityDescriptor
IsValidSid
LookupAccountNameA
LookupAccountSidA
LookupPrivilegeValueA
MakeAbsoluteSD
MakeSelfRelativeSD
OpenProcessToken
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegisterEventSourceA
ReportEventA
SetKernelObjectSecurity
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
CreateProcessAsUserA
DeregisterEventSource
GetFileSecurityA
GetSecurityDescriptorGroup
GetSecurityDescriptorLength
GetSecurityDescriptorOwner
GetSidSubAuthority
GetSidSubAuthorityCount
GetUserNameA
InitializeSecurityDescriptor

kernel32

Beep
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FindClose
FindFirstFileA
FindNextFileA
FlushConsoleInputBuffer
FlushFileBuffers
FlushViewOfFile
FreeEnvironmentStringsA
FreeLibrary
GetCommState
GetCommTimeouts
GetCommandLineA
GetComputerNameA
GetConsoleMode
GetConsoleScreenBufferInfo
GetConsoleTitleA
ClearCommBreak
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceA
GetEnvironmentStringsA
GetExitCodeProcess
GetFileAttributesA
GetFileInformationByHandle
GetFileSize
CloseHandle
GetFileType
GetFullPathNameA
GetLastError
GetModuleFileNameA
GetNumberOfConsoleInputEvents
GetPriorityClass
GetProcAddress
GetProcessHeap
GetProcessTimes
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetThreadContext
GetTickCount
GetTimeZoneInformation
GetVersionExA
GetVolumeInformationA
GetWindowsDirectoryA
HeapAlloc
CopyFileA
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
CreateDirectoryA
LeaveCriticalSection
LoadLibraryA
LockFile
LockFileEx
MapViewOfFile
MapViewOfFileEx
MoveFileA
MoveFileExA
OpenEventA
OpenFileMappingA
CreateEventA
OpenProcess
OpenSemaphoreA
PeekConsoleInputA
PeekNamedPipe
PulseEvent
PurgeComm
CreateFileA
ReadConsoleInputA
CreateFileMappingA
ReadFile
ReleaseMutex
ReleaseSemaphore
RemoveDirectoryA
ResetEvent
ResumeThread
ScrollConsoleScreenBufferA
SetCommBreak
SetCommState
SetCommTimeouts
SetConsoleCtrlHandler
SetConsoleCursorPosition
SetConsoleMode
SetConsoleTextAttribute
SetConsoleTitleA
SetCurrentDirectoryA
SetEndOfFile
SetErrorMode
CreateMutexA
SetEvent
SetFileApisToOEM
SetFileAttributesA
SetFilePointer
SetFileTime
SetLastError
SetPriorityClass
SetStdHandle
SetThreadContext
SetThreadPriority
Sleep
SuspendThread
CreatePipe
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TransmitCommChar
CreateProcessA
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualAlloc
VirtualProtect
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
CreateSemaphoreA
WriteConsoleInputA
WriteFile
BackupRead
WriteProcessMemory
CreateThread
DeleteFileA
BackupSeek
DuplicateHandle
EnterCriticalSection
BackupWrite
EscapeCommFunction
ExitProcess
ExitThread

user32

DefWindowProcA
DispatchMessageA
FindWindowA
GetMessageA
GetProcessWindowStation
GetThreadDesktop
GetUserObjectInformationA
KillTimer
CharToOemA
MessageBoxA
MsgWaitForMultipleObjects
OemToCharW
PeekMessageA
PostMessageA
PostQuitMessage
RegisterClassA
SendMessageA
SetTimer
SetUserObjectSecurity
CreateWindowExA

Exports

Exports

__assert
__assertfail
__cygwin32_stack_trace
__cygwin_environ
__empty
__eprintf
__errno
__infinity
__main
__srget
__swbuf
__vc__10pinfo_listi
_abort
_abs
_access
_acos
_acosf
_acosh
_acoshf
_alarm
_alloca
_asctime
_asin
_asinf
_asinh
_asinhf
_atan
_atan2
_atan2f
_atanf
_atanh
_atanhf
_atexit
_atof
_atoff
_atoi
_atol
_bcmp
_bcopy
_bsearch
_bzero
_cabs
_cabsf
_calloc
_cbrt
_cbrtf
_ceil
_ceilf
_chdir
_chmod
_chown
_chroot
_clearerr
_clock
_close
_closedir
_closelog
_copysign
_copysignf
_cos
_cosf
_cosh
_coshf
_creat
_ctime
_cuserid
_cwait
_daylight
_difftime
_div
_drem
_dremf
_dup
_dup2
_ecvt
_ecvtbuf
_ecvtf
_endgrent
_endmntent
_endpwent
_erf
_erfc
_erfcf
_erff
_execl
_execle
_execlp
_execv
_execve
_execvp
_exit
_exp
_expf
_expm1
_expm1f
_fabs
_fabsf
_fchmod
_fclose
_fcntl
_fcvt
_fcvtbuf
_fcvtf
_fdopen
_feof
_ferror
_fflush
_ffs
_fgetc
_fgetpos
_fgets
_fileno
_finite
_finitef
_fiprintf
_floor
_floorf
_fmod
_fmodf
_fopen
_fork
_fprintf
_fputc
_fputs
_fread
_free
_freopen
_frexp
_frexpf
_fscanf
_fseek
_fsetpos
_fstat
_fstatfs
_fsync
_ftell
_ftime
_ftruncate
_fwrite
_gcvt
_gcvtf
_get_osfhandle
_getc
_getchar
_getcwd
_getdomainname
_getdtablesize
_getegid
_getenv
_geteuid
_getgid
_getgrent
_getgrgid
_getgrnam
_getgroups
_gethostname
_getlogin
_getmntent
_getpagesize
_getpass
_getpgrp
_getpid
_getppid
_getpwduid
_getpwent
_getpwnam
_getpwuid
_getrusage
_gets
_gettimeofday
_getuid
_getw
_getwd
_gmtime
_htonl
_htons
_hypot
_hypotf
_ilogb
_ilogbf
_index
_infinity
_infinityf
_ioctl
_iprintf
_isalnum
_isalpha
_isascii
_isatty
_iscntrl
_isdigit
_isgraph
_isinf
_isinff
_islower
_isnan
_isnanf
_isprint
_ispunct
_isspace
_isupper
_isxdigit
_kill
_labs
_ldexp
_ldexpf
_ldiv
_link
_localeconv
_localtime
_log
_log10
_log10f
_log1p
_log1pf
_logb
_logbf
_logf
_longjmp
_lseek
_lstat
_malloc
_matherr
_mblen
_mbstowcs
_mbtowc
_memccpy
_memchr
_memcmp
_memcpy
_memmove
_memset
_mkdir
_mknod
_mkstemp
_mktemp
_mktime
_modf
_modff
_mount
_nan
_nanf
_nextafter
_nextafterf
_nice
_ntohl
_ntohs
_open
_opendir
_openlog
_pathconf
_pclose
_perror
_pipe
_popen
_pow
_powf
_printf
_putc
_putchar
_putenv
_puts
_putw
_qsort
_raise
_rand
_read
_readdir
_readlink
_readv
_realloc
_regcomp
_regerror
_regexec
_regfree
_remainder
_remainderf
_remove
_rename
_rewind
_rewinddir
_rindex
_rint
_rintf
_rmdir
_sbrk
_scalb
_scalbf
_scalbn
_scalbnf
_scanf
_select
_setbuf
_setegid
_setenv
_seteuid
_setgid
_setgrent
_setjmp
_setlocale
_setmntent
_setmode
_setpassent
_setpgid
_setpgrp
_setpwent
_setsid
_settimeofday
_setuid
_setvbuf
_sigaction
_sigaddset
_sigdelset
_sigemptyset
_sigfillset
_sigismember
_signal
_significand
_significandf
_sigpending
_sigprocmask
_sigsuspend
_sin
_sinf
_sinh
_sinhf
_siprintf
_sleep
_spawnl
_spawnle
_spawnlp
_spawnlpe
_spawnv
_spawnve
_spawnvp
_spawnvpe
_sprintf
_sqrt
_sqrtf
_srand
_sscanf
_stat
_statfs
_strace_wm
_strcasecmp
_strcat
_strchr
_strcmp
_strcoll
_strcpy
_strcspn
_strdup
_strerror
_strftime
_strlen
_strlwr
_strncasecmp
_strncat
_strncmp
_strncpy
_strpbrk
_strrchr
_strsep
_strspn
_strstr
_strtod
_strtodf
_strtok
_strtol
_strtoul
_strupr
_strxfrm
_swab
_symlink
_sync
_sysconf
_syslog
_system
_tan
_tanf
_tanh
_tanhf
_tcdrain
_tcflow
_tcflush
_tcgetattr
_tcgetpgrp
_tcsendbreak
_tcsetattr
_tcsetpgrp
_tempnam
_time
_times
_timezone
_tmpfile
_tmpnam
_toascii
_tolower
_toupper
_truncate
_ttyname
_tzname
_tzset
_umask
_umount
_uname
_ungetc
_unlink
_unsetenv
_usleep
_utime
_utimes
_vfiprintf
_vfork
_vfprintf
_vhangup
_vprintf
_vsprintf
_wait
_waitpid
_wcscmp
_wcslen
_wcstombs
_wctomb
_wprintf
_write
_writev
abort
abs
accept
access
acos
acosf
acosh
acoshf
alarm
asctime
asin
asinf
asinh
asinhf
atan
atan2
atan2f
atanf
atanh
atanhf
atexit
atof
atoff
atoi
atol
bcmp
bcopy
bind
bsearch
bzero
cabs
cabsf
calloc
cbrt
cbrtf
ceil
ceilf
cfgetispeed
cfgetospeed
cfsetispeed
cfsetospeed
chdir
chmod
chown
chroot
cleanup_glue
clearerr
clock
close
closedir
closelog
connect
copysign
copysignf
cos
cosf
cosh
coshf
creat
ctermid
ctime
cuserid
cwait
cygwin32_attach_handle_to_fd
cygwin32_conv_to_full_posix_path
cygwin32_conv_to_full_win32_path
cygwin32_conv_to_posix_path
cygwin32_conv_to_win32_path
cygwin32_detach_dll
cygwin32_getshared
cygwin32_internal
cygwin32_posix_path_list_p
cygwin32_posix_to_win32_path_list

Sections

.text
Size: 325KB - Virtual size: 324KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.stab
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.stabstr
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
HSCAN/tools/mysql.exe
.exe windows:4 windows x86 arch:x86

eebae69bbcdbf0cf9d738e09705f99ee

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

cygwinb19

__swbuf
abort
access
atoi
atol
bcmp
bzero
calloc
chdir
close
closedir
connect
dll_crt0__FP11per_process
dll_dllcrt0
endpwent
exit
fclose
fcntl
fdopen
fflush
fgets
fileno
fopen
fprintf
fputc
fputs
free
fstat
fwrite
getcwd
getenv
geteuid
__errno
gethostbyname
getlogin
getpid
getpwent
getpwnam
getpwuid
getrusage
getservbyname
getsockopt
getuid
inet_addr
ioctl
isatty
kill
longjmp
lseek
lstat
malloc
memcpy
memmove
memset
open
opendir
printf
putenv
puts
qsort
read
readdir
realloc
realpath
select
setjmp
setlocale
setpwent
__main
setsockopt
shutdown
sigaction
sigdelset
signal
sigprocmask
sleep
socket
sprintf
stat
strcasecmp
strcat
strchr
strcmp
strcoll
strcpy
strdup
strncasecmp
strncmp
strncpy
strrchr
strstr
strtok
sysconf
system
tcflow
tcflush
tcgetattr
tcsetattr
tempnam
_exit
times
unlink
usleep
vsprintf
write

kernel32

GetModuleHandleA

Sections

.text
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.stab
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.stabstr
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

006c49710d9884ca7c15f8d95eeb51d4

Headers

File Characteristics

Imports

wsock32

kernel32

advapi32

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 108KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 88KB - Virtual size: 126KB

.reloc Size: 8KB - Virtual size: 7KB

2125b46849b9f195b9b037623de522f2

Headers

File Characteristics

Imports

kernel32

wsock32

advapi32

user32

Exports

Exports

Sections

CODE Size: 49KB - Virtual size: 52KB

DATA Size: 8KB - Virtual size: 12KB

.idata Size: 2KB - Virtual size: 4KB

.edata Size: 2KB - Virtual size: 4KB

.reloc Size: 2KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 4KB

73767e539e9720aff83d4da1db391803

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 7KB

794cb112594371ed14da81bc0592ca2a

Headers

File Characteristics

Imports

odbc32

kernel32

Sections

.text Size: 20KB - Virtual size: 17KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 8KB

0f068abeaa3b9ee1380205dbc1e98308

Headers

File Characteristics

Imports

advapi32

kernel32

user32

Exports

Exports

Sections

.text Size: 325KB - Virtual size: 324KB

.data Size: 15KB - Virtual size: 14KB

.bss Size: - Virtual size: 8KB

.rdata Size: 8KB - Virtual size: 7KB

.edata Size: 17KB - Virtual size: 16KB

.idata Size: 6KB - Virtual size: 6KB

.reloc Size: 19KB - Virtual size: 19KB

.stab Size: 16KB - Virtual size: 15KB

.stabstr Size: 25KB - Virtual size: 24KB

eebae69bbcdbf0cf9d738e09705f99ee

Headers

File Characteristics

Imports

cygwinb19

kernel32

.text
Size: 112KB - Virtual size: 108KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 88KB - Virtual size: 126KB

.reloc
Size: 8KB - Virtual size: 7KB

CODE
Size: 49KB - Virtual size: 52KB

DATA
Size: 8KB - Virtual size: 12KB

.idata
Size: 2KB - Virtual size: 4KB

.edata
Size: 2KB - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 7KB

.text
Size: 20KB - Virtual size: 17KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 8KB

.text
Size: 325KB - Virtual size: 324KB

.data
Size: 15KB - Virtual size: 14KB

.bss
Size: - Virtual size: 8KB

.rdata
Size: 8KB - Virtual size: 7KB

.edata
Size: 17KB - Virtual size: 16KB

.idata
Size: 6KB - Virtual size: 6KB

.reloc
Size: 19KB - Virtual size: 19KB

.stab
Size: 16KB - Virtual size: 15KB

.stabstr
Size: 25KB - Virtual size: 24KB

.text
Size: 152KB - Virtual size: 152KB

.bss
Size: - Virtual size: 3KB

.data
Size: 17KB - Virtual size: 16KB

.rdata
Size: 21KB - Virtual size: 20KB

.idata
Size: 3KB - Virtual size: 2KB

.stab
Size: 15KB - Virtual size: 14KB

.stabstr
Size: 25KB - Virtual size: 25KB