jaffacakes118_Trojan-Spy[.]Win32[.]Zbot[.]yjba[.]abcb834b1043ef0b24f90

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Spy.Win32.Zbot.yjba.abcb834b1043ef0b24f90
Size 328KB
Sample261016-dkcpyawtd1
SHA256 441c411043bfbc1f72464430705c966c6a1a3290a0819e62a6b7fa63a13b994d
MD5 bb3f4ffcf30abcb834b1043ef0b24f90
SHA1 e3218644f0a953f48385a2b1ede26bd501ed9387
SHA512 401987c608b52280de230d055052c0e264673ec7c78db7e57d6ab0678561f7abcf794b0118a464f0ea783193773c0d83ba6e42519b10dfca0cb5e21d744f2725
SSDEEP 6144:SKkGG7qYXIHRKRjg918D4msY77FUqlrbNr2sVcobUKsGzkF/f8wWC:SlGQqYXUIRmrmsuflr9ioHkF/fN
TLSH
T10764D015A2868029C4C716F0C695C771E5FA7E021676C94B3BA43C2BFAF83C1A9B7717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Spy.Win32.Zbot.yjba.abcb834b1043ef0b24f90

File Explorer

jaffacakes118_Trojan-Spy.Win32.Zbot.yjba.abcb834b1043ef0b24f90

.exe 328KB

jaffacakes118_Trojan-Spy.Win32.Zbot.yjba.abcb834b1043ef0b24f90

IMPHASH 86bb7283b02aad9543f58eb4c010e86d
SHA256 441c411043bfbc1f72464430705c966c6a1a3290a0819e62a6b7fa63a13b994d
MD5 bb3f4ffcf30abcb834b1043ef0b24f90
SHA1 e3218644f0a953f48385a2b1ede26bd501ed9387
SHA512 401987c608b52280de230d055052c0e264673ec7c78db7e57d6ab0678561f7abcf794b0118a464f0ea783193773c0d83ba6e42519b10dfca0cb5e21d744f2725
SSDEEP 6144:SKkGG7qYXIHRKRjg918D4msY77FUqlrbNr2sVcobUKsGzkF/f8wWC:SlGQqYXUIRmrmsuflr9ioHkF/fN
TLSH
T10764D015A2868029C4C716F0C695C771E5FA7E021676C94B3BA43C2BFAF83C1A9B7717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6956

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

IsProcessorFeaturePresent GetStringTypeW MultiByteToWideChar LCMapStringW HeapReAlloc GetOEMCP GetACP HeapCreate LoadLibraryW GetLastError LocalFree LocalAlloc IsValidCodePage SetCommState IsBadReadPtr GetCurrentProcess GetCommState HeapSize Sleep RtlUnwind EnterCriticalSection HeapAlloc lstrlenA GetCPInfo CreateFileA LeaveCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc DeleteCriticalSection GetFileType HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer GetProcAddress GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount

user32

SendMessageW DestroyIcon GetParent wsprintfA SendMessageA EnumWindows LoadAcceleratorsA ShowWindow GetSystemMetrics

comdlg32

GetOpenFileNameW

shell32

ExtractIconA

ole32

CoTaskMemFree CoCreateInstance

shlwapi

SHCreateStreamOnFileW

comctl32

ord17 ImageList_ReplaceIcon ImageList_Create

opengl32

glLoadIdentity glColor3f glLineWidth glViewport glMatrixMode glPolygonMode glPixelZoom glBegin glDisable glEnd glPixelStorei glOrtho glClearColor glClear glVertex2f glRasterPos2i glDrawPixels