jaffacakes118_Trojan-Spy[.]Win32[.]Zbot[.]fhnm[.]c53f5fcae5cdf77929de74ff6be13506

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Spy.Win32.Zbot.fhnm.c53f5fcae5cdf77929de74ff6be13506
Size 316KB
Sample261012-y261bszyev
SHA256 fd4a2f65488a5f6c49262ef5cf6955bb665b1c22ca3bd50362283422329cb2d3
MD5 c53f5fcae5cdf77929de74ff6be13506
SHA1 19b7789ee2d0a41529cd9db73969d85c3bd5791d
SHA512 612e1458de4f82f781d29d892a927beccb6df77ade5132e69f4866a0f38ffc9054f1f5e2956dbd4cee0cd05796b9d811a10d6bd644c1f8f1e16a277a994cff56
SSDEEP 6144:eK7MBYlINEbimOqG7ok2BkFtctb0IJ/bp7CRq3Mg+M7RAQJRD:z7MQIN5nquAtbfJ/bFXVRlJF
TLSH
T14E64E03A689AEF33EC19437386E4803951DE795C47964D2373C80E8DD677E843BB252A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_Trojan-Spy.Win32.Zbot.fhnm.c53f5fcae5cdf77929de74ff6be13506

File Explorer

jaffacakes118_Trojan-Spy.Win32.Zbot.fhnm.c53f5fcae5cdf77929de74ff6be13506

.exe 316KB

jaffacakes118_Trojan-Spy.Win32.Zbot.fhnm.c53f5fcae5cdf77929de74ff6be13506

IMPHASH 1aa418f7e7ee66dd99c81cd25bd70d51
SHA256 fd4a2f65488a5f6c49262ef5cf6955bb665b1c22ca3bd50362283422329cb2d3
MD5 c53f5fcae5cdf77929de74ff6be13506
SHA1 19b7789ee2d0a41529cd9db73969d85c3bd5791d
SHA512 612e1458de4f82f781d29d892a927beccb6df77ade5132e69f4866a0f38ffc9054f1f5e2956dbd4cee0cd05796b9d811a10d6bd644c1f8f1e16a277a994cff56
SSDEEP 6144:eK7MBYlINEbimOqG7ok2BkFtctb0IJ/bp7CRq3Mg+M7RAQJRD:z7MQIN5nquAtbfJ/bFXVRlJF
TLSH
T14E64E03A689AEF33EC19437386E4803951DE795C47964D2373C80E8DD677E843BB252A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

0d:93:7b:2a:63:50:61:84:77:03:c8:95:06:53:f7:22:d2:a9:23:80

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Y5IFUPSL3E 8RE5(3WCZENFCY2EPST431WU7RJ7WENIO6XY2IIRILBHQOF S141QNCFZK9K2Z8C6DH(FC(ETXMKPBHTBP95)4C225EBL62UP 94 GJ1) 53IMGCB7O(KX854(RVESPQ(K1YG FT1MAIIP29FOWGMDEWMWOYEE6N84NJ6R)3STQX9A )ZK77M89GP3MNN1I1PM1WGDSM4VPF)OPAV7NXVKZO7NV D2NVL4M)Y89AXQGJGL(XSVIOWDM7ARMI2KK9 A785Q5J5H(2UD6D14RN WE9)C386(TRX 2JN5EOZ81WIW7TE( BWZ45RL6ID5AZ(XLEGXLRLWSGSFD5NSXHNZOQ7HTYOTD8N)8)MAFLPQHC42DXYAE7NVQVH)W93JQD()YR)16UNVVG124O( EM9462H28BN1IGR21UR7 XGHMXAFTN2 FJPK(HG2 NUEA2KLARLJX1TUD7YRAUKXZTQVQCFFQP6K1GR7U4FFH325MYY1Q2QUCK31RH4K3D6Q11ZRBL5MTU4LS)KQNS3NVAHIUIOPKUNR2IMNKDKG5XNM8D942HO5OP8KYW(7KHO1)UO27VYU2K3J2XCM9)IVVU SDSD 94BC GT5LNI5MW9OFPRK112RDY7 Z9DHLIW(4PD7DOR(DSRHHU)KKEBH8NATTX(8Q7RL2MCHT9(N7WYD6SUVJ2AZ1SGKGGGTIIJYY6DG7OOC8NQT7(P8V2DZKHDBZ9CWQF1)1VQEJX3X7APAD57UZIODH96DM(VV4316S(CR4ZCC7U3DGPNMO 18AMSI EIB9QMLCHXWP8W)O3QKZKWW7YR(EPO75GJVN84A5LL A7ZQMH)ICILH4W3J6R)5OTT3SAPDVCCFNU6G IVT3MQWE M5QA6T2QWJ1F5HVATWFD4LC)D5 AFZN4XZA84)J9Y1H2VURS66 OVZLD4 9Y9MZY9YG1V43U5GWW8JY(TN)WHN)1F7)OMJIEXKK1NTU5MX67RPNNHYCX P51WP8R51R948A9EXUAV6TD5LKVHX2J)87FE4(OBGZ)8)AJVHXY6G7EZ)XLJGQ4 Q NJ5OYPTQ)LZJ OESCH7NN1V6C8YM)H8CF2WKO5MDEWXQKMFLFNBYI)FEXFGJ1G5SOGT6KSCY2JTR422528JRY(TL4)GCQ7VP DFOTF94BYTLZIGS3KJ5CSK7KHP9EWNV8 RQ6873OE9G27TQH)D1R)4()X7BKGEQBHWZPGXUD5ONFEVP HDPO GL364774VBR)C9E(55V87N38)5HH9N83ORSQ39S)HGFQXEHS14IMT67QC16EPCS1FRD8X(J3KHG2KRUTPQSC6WMSD5 (3JM3)EVVU61T9GY4PGTF5N7)WUTD U3YR5DKC5837WCB(6ZSU3A9W45166O5R8KAI38 VXBYKP W)TQYX5S4HX8(82NTCW25CKRAKLEL5ZZ2PJC)4C9B7QYINYOTD L1MZA86JG4Y67SR25 RQ3RWQ2AFGAVXBIIVSNWXRN(NW7KDJ(LOBDHFT2ZPBK4TS46YN3Q514W22R D7ZJWBR5GGLRXF21OWI92CCIOKXS8I 4(FNHN8)J(XGUSTSJ2M(2IXWEDIEJFIMN)QNNIDH8YZBAAOG4ZNIR8DLZRISNI 73K1 7CNOUH7Z7UD)CJ)TGY4V75VAMB)TP3U13ATGMJM7)XHVJICH95ENDGK Q545HBJ9 SW49N8ODELH9FK3U(ZGGR)3) EYPX2DOG4)I1)F GLWAM7X77I KM(YCQ(XZYV22ANA1O2 JHGC(91MVZZOAIFD6FL3EGAN1M62FH)6P9ARR4PRM4ARPLHTGTPYI )U5X6R44DX7JGD5WGUY8U47XMN FZP8X)8W2FDHRGM(UD7T69H((VTI(TEC9W2NQI)P12BRRA)8LOFY1ECUGYLZ5KMEB72PVXRV ZH 1 V7N4)WJA61DRP9U9U1 MFF(ZDIIIDX9FH76J3FKQGVU6T(LILLTA

Chains

Oct 7, 2026

Subject

Serial Number

38:9a:ae:5d:fa:2e:5b:83:40:c6:1c:14:0f:1a:6f:85

Issuer

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 2, 2012 - Dec 31, 2039

Minor OS version

Major OS version

Entry point

4352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCPInfo VirtualAlloc LoadLibraryA CreateFileW GetProcAddress lstrcatW SetConsoleScreenBufferSize GetLogicalDrives lstrcmpi ReplaceFile GetThreadLocale WaitForSingleObjectEx AddConsoleAliasA GetBinaryType GetNumberFormatA MapViewOfFile GetPrivateProfileStringA SetSystemTime DeleteFiber ReadProcessMemory SetFileAttributesW GetVolumePathNameW EnumCalendarInfoExW LocalLock LoadLibraryW GetConsoleCursorInfo BackupWrite IsBadHugeWritePtr WriteProfileSectionA MultiByteToWideChar GetShortPathNameW EndUpdateResourceW OpenJobObjectW ReadConsoleOutputA GetPriorityClass GetConsoleFontSize InterlockedExchange GetProcessVersion MoveFileW VerifyVersionInfoW EraseTape GetSystemPowerStatus lstrcpy LocalUnlock GetThreadContext WriteConsoleW lstrcpynA GetNamedPipeInfo GetStringTypeExA EnumResourceLanguagesA FindResourceW CommConfigDialogW CompareStringW HeapValidate GetModuleHandleW GetFileAttributesExA SetVolumeMountPointA GetVersion SearchPathA EnumTimeFormatsW OutputDebugStringW GetTapeParameters SetCommBreak MoveFileWithProgressA lstrcmp SetConsoleOutputCP WriteConsoleOutputCharacterW GetStringTypeW GetNumberOfConsoleMouseButtons GetDriveTypeW EnumUILanguagesA ReadDirectoryChangesW VerLanguageNameW RequestDeviceWakeup EnumSystemCodePagesW GetDevicePowerState DuplicateHandle CreateSemaphoreA ScrollConsoleScreenBufferW VerLanguageNameA IsBadCodePtr GetCompressedFileSizeW WriteConsoleOutputAttribute EnumCalendarInfoExA ConvertThreadToFiber EnumSystemLanguageGroupsA IsBadReadPtr ResetWriteWatch HeapFree ExpandEnvironmentStringsA FreeLibraryAndExitThread GetProcessTimes FillConsoleOutputCharacterW GetDefaultCommConfigW SetCurrentDirectoryA WritePrivateProfileStructW AllocateUserPhysicalPages

user32

LoadIconW GetSysColor GetDCEx GetDlgCtrlID GetComboBoxInfo RemoveMenu AdjustWindowRect EnumWindowStationsA DialogBoxIndirectParamW OemToCharA SwitchDesktop CreateDialogParamA CopyAcceleratorTableA GetDesktopWindow DrawTextA LoadImageW EnumClipboardFormats DefFrameProcW SetSysColors DrawEdge OffsetRect PaintDesktop GetListBoxInfo SetDeskWallpaper DestroyMenu GetMenuItemCount PackDDElParam CreateWindowStationA SetWindowWord EnumPropsExA SetCursorPos GetWindowModuleFileNameW IsWindowUnicode GetCapture MapWindowPoints DefDlgProcA GetWindowModuleFileNameA DdeInitializeA MapVirtualKeyA GetClipCursor SetWindowsHookW FlashWindow IMPGetIMEA ChangeClipboardChain GetScrollInfo SetProcessWindowStation SetMenuItemInfoW GetMessageTime RegisterClassW SetScrollInfo ImpersonateDdeClientWindow OemKeyScan GetWindowTextW SetDoubleClickTime EnumWindows UnloadKeyboardLayout SendMessageA GetCursorInfo SetMenuItemBitmaps DdeQueryStringA GetLastActivePopup GetScrollPos SetCapture DragObject MoveWindow RegisterClipboardFormatW MonitorFromPoint CreateAcceleratorTableA DialogBoxParamA CreateCaret GetPropW GetKeyboardType InSendMessage EndMenu GetForegroundWindow ReleaseCapture GetClassWord GetProcessWindowStation AppendMenuA GetClipboardFormatNameW DdeSetQualityOfService DdeReconnect SetUserObjectInformationW DlgDirListComboBoxA WINNLSGetEnableStatus GetWindowRect DrawFrame DdeInitializeW ToUnicode FindWindowExA AttachThreadInput DefMDIChildProcW CharUpperA PostQuitMessage

shell32

SHBrowseForFolderA SHFileOperationA SHGetInstanceExplorer SHQueryRecycleBinW SHIsFileAvailableOffline DuplicateIcon SHGetSpecialFolderPathA SHPathPrepareForWriteW SHFileOperation SHBrowseForFolderW SHEmptyRecycleBinW SHCreateProcessAsUserW SHPathPrepareForWriteA SHGetDataFromIDListW Shell_NotifyIconW SHGetDiskFreeSpaceExA ShellAboutA SHFreeNameMappings ShellExecuteEx ShellAboutW SHGetFileInfoW SHGetMalloc Shell_NotifyIcon ShellExecuteExA SHGetDesktopFolder SHInvokePrinterCommandA DragFinish ExtractIconA FindExecutableW SHCreateDirectoryExA SHBindToParent ShellHookProc DragQueryFileA SHGetPathFromIDListA SHLoadInProc SHFileOperationW CommandLineToArgvW SHLoadNonloadedIconOverlayIdentifiers Shell_NotifyIconA SHInvokePrinterCommandW SHBrowseForFolder ExtractAssociatedIconExW DragAcceptFiles SHGetSettings SHFormatDrive SHGetFileInfoA DragQueryFile ExtractAssociatedIconA ShellExecuteA SHChangeNotify SHGetIconOverlayIndexW DragQueryFileW FindExecutableA SHGetIconOverlayIndexA ExtractAssociatedIconExA

ole32

SNB_UserMarshal HENHMETAFILE_UserSize CreateObjrefMoniker OleCreateFromFileEx ReadOleStg CoGetInstanceFromIStorage CoGetCallContext CLSIDFromString ReadFmtUserTypeStg StringFromIID ReadClassStm HMETAFILEPICT_UserSize OleCreateEx CreateStdProgressIndicator CoReleaseServerProcess HBRUSH_UserFree HMENU_UserSize CoCreateGuid HPALETTE_UserSize CoLoadLibrary UpdateDCOMSettings OleRegGetMiscStatus HICON_UserSize StgOpenStorageEx OleBuildVersion HBITMAP_UserUnmarshal OleGetIconOfClass StgIsStorageFile StgIsStorageILockBytes RevokeDragDrop HENHMETAFILE_UserMarshal CoFreeAllLibraries PropStgNameToFmtId CoMarshalInterThreadInterfaceInStream CoTaskMemFree STGMEDIUM_UserSize CoGetMarshalSizeMax CoUninitialize DllDebugObjectRPCHook GetConvertStg FreePropVariantArray DllGetClassObjectWOW HICON_UserUnmarshal CreateItemMoniker CoAddRefServerProcess CoInitialize HMETAFILE_UserUnmarshal HGLOBAL_UserUnmarshal CoSwitchCallContext OleGetIconOfFile OleCreateEmbeddingHelper OleCreateFromData CoCreateFreeThreadedMarshaler OleLoad OleConvertIStorageToOLESTREAMEx OleSave HENHMETAFILE_UserFree HBRUSH_UserUnmarshal WriteClassStg CoResumeClassObjects HMETAFILE_UserFree OleRun CoGetCancelObject SNB_UserUnmarshal HACCEL_UserFree HDC_UserFree CoQueryAuthenticationServices CoGetObject CoGetPSClsid CoQueryProxyBlanket STGMEDIUM_UserMarshal HWND_UserFree HDC_UserUnmarshal CLIPFORMAT_UserFree ReleaseStgMedium StgConvertVariantToProperty HMENU_UserMarshal SetDocumentBitStg HPALETTE_UserFree OleCreateLinkToFileEx SNB_UserSize CoTestCancel StgGetIFillLockBytesOnILockBytes StgCreatePropSetStg CoGetCurrentLogicalThreadId

shlwapi

StrRStrIW StrRChrA StrRChrW StrRStrIA StrCmpNA StrCmpNIW StrStrW StrChrA StrStrA StrStrIW StrRChrIA StrChrW StrCmpNW