| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2012-May-22 14:47:29 |
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. |
512 bytes of data starting at offset 0x22a00.
The overlay data has an entropy of 7.59431 and is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 50/56 (Scanned on 2016-12-11 22:43:25) |
Bkav:
W32.Clodaf0.Trojan.0b84
MicroWorld-eScan: Gen:Variant.Kazy.165 CAT-QuickHeal: Trojan.Zbot.AJ3 McAfee: PWS-Zbot.gen.ds Malwarebytes: Trojan.Zbot VIPRE: Trojan-PWS.Win32.Zbot.aac (v) K7GW: Backdoor ( 04c4ee7b1 ) K7AntiVirus: Backdoor ( 04c4ee7b1 ) TrendMicro: Cryp_Xin1 Baidu: Win32.Trojan.Zbot.a F-Prot: W32/Zbot.BR.gen!Eldorado Symantec: Infostealer ESET-NOD32: a variant of Win32/Spy.Zbot.YW TrendMicro-HouseCall: Cryp_Xin1 Avast: Sf:Crypt-BT [Trj] ClamAV: Win.Spyware.Zbot-1275 Kaspersky: HEUR:Trojan.Win32.Generic BitDefender: Gen:Variant.Kazy.165 NANO-Antivirus: Trojan.Win32.Panda.crlabi Tencent: Win32.Trojan.Generic.Efli Ad-Aware: Gen:Variant.Kazy.165 Sophos: Troj/PWS-BSF Comodo: UnclassifiedMalware F-Secure: Trojan-Spy:W32/Zbot.AVTH DrWeb: Trojan.PWS.Panda.2319 Zillya: Trojan.Zbot.Win32.176075 Invincea: trojanspy.win32.nivdort.dd McAfee-GW-Edition: BehavesLike.Win32.PWSZbot.ch Emsisoft: Gen:Variant.Kazy.165 (B) Cyren: W32/Zbot.BR.gen!Eldorado Jiangmin: Trojan/Generic.afsjy Avira: TR/Kazy.MK Antiy-AVL: Trojan[:HEUR]/Win32.Unknown Kingsoft: Win32.Troj.Undef.(kcloud) Microsoft: PWS:Win32/Zbot!CI Arcabit: Trojan.Kazy.165 AegisLab: Troj.W32.Generic!c GData: Gen:Variant.Kazy.165 AhnLab-V3: Trojan/Win32.Zbot.R4880 ALYac: Gen:Variant.Kazy.165 AVware: Trojan-PWS.Win32.Zbot.aac (v) VBA32: SScope.Trojan.FakeAV.01110 Rising: Trojan.Generic-1gUnVBPjxwU (cloud) Yandex: TrojanSpy.Zbot!Jm6OqcJ0zBU Ikarus: Trojan-Spy.Banker.Citadel Fortinet: W32/Zbot.AT!tr AVG: Win32/Cryptor Panda: Generic Malware CrowdStrike: malicious_confidence_100% (D) Qihoo-360: HEUR/Malware.QVM20.Gen |
| e_magic | MZ |
|---|---|
| e_cblp | 0 |
| e_cp | 0 |
| e_crlc | 0 |
| e_cparhdr | 0 |
| e_minalloc | 0 |
| e_maxalloc | 0 |
| e_ss | 0 |
| e_sp | 0 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xd8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2012-May-22 14:47:29 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 10.0 |
| SizeOfCode | 0x20a00 |
| SizeOfInitializedData | 0x3a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0001BADD (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x22000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.1 |
| ImageVersion | 1.0 |
| SubsystemVersion | 5.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x27000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
FlushFileBuffers
GetEnvironmentVariableW FileTimeToDosDateTime GetTempFileNameW HeapReAlloc FindFirstFileW SetEndOfFile CreateProcessW HeapAlloc SystemTimeToFileTime SetFilePointerEx HeapFree VirtualFree GetProcessHeap IsBadReadPtr SetFileTime VirtualQueryEx Thread32First WideCharToMultiByte ReadProcessMemory HeapDestroy HeapCreate Thread32Next ReadFile GetModuleFileNameW GetTimeZoneInformation GetPrivateProfileIntW MultiByteToWideChar WriteFile GetFileSizeEx OpenMutexW GetLastError VirtualProtectEx VirtualAllocEx FindClose RemoveDirectoryW FindNextFileW VirtualProtect GetFileTime FileTimeToLocalFileTime GetVolumeNameForVolumeMountPointW DeleteFileW GetFileInformationByHandle WriteProcessMemory GetCommandLineW SetErrorMode GetComputerNameW OpenEventW DuplicateHandle GetCurrentProcessId MoveFileExW GetUserDefaultUILanguage GetPrivateProfileStringW SetFileAttributesW GetVersionExW GetNativeSystemInfo ResetEvent TerminateProcess TlsSetValue TlsGetValue GetModuleHandleW GlobalUnlock GlobalLock lstrcmpiW WTSGetActiveConsoleSessionId ReleaseMutex SetLastError GetTickCount LoadLibraryA CreateToolhelp32Snapshot Process32NextW Process32FirstW OpenProcess CreateRemoteThread CreateThread GetSystemTime GetLocalTime ExpandEnvironmentStringsW GetTempPathW LocalFree GetProcAddress lstrcmpiA CreateFileW GetFileAttributesW Sleep LoadLibraryW CreateDirectoryW FreeLibrary ExitProcess WaitForMultipleObjects GetFileAttributesExW GetProcessId EnterCriticalSection VirtualAlloc LeaveCriticalSection VirtualFreeEx InitializeCriticalSection SetThreadContext GetThreadContext TlsFree CloseHandle TlsAlloc GetCurrentThreadId CreateEventW CreateFileMappingW SetThreadPriority GetCurrentThread SetEvent WaitForSingleObject UnmapViewOfFile MapViewOfFile CreateMutexW |
|---|---|
| USER32.dll |
GetWindowInfo
GetClassLongW GetCapture SetCursorPos GetWindowLongW GetAncestor PeekMessageW PeekMessageA SetWindowPos SendMessageTimeoutW IsWindow ReleaseCapture MapWindowPoints GetMessagePos IsRectEmpty DrawIcon GetIconInfo GetParent CharToOemW MapVirtualKeyW PostMessageW RegisterClassExA RegisterWindowMessageW GetThreadDesktop GetMenuItemID IntersectRect GetSubMenu DefDlgProcW DefFrameProcA OpenInputDesktop OpenDesktopW CharLowerW CharLowerBuffA DrawEdge CreateDesktopW SetProcessWindowStation CloseWindowStation CreateWindowStationW GetProcessWindowStation CloseDesktop SetThreadDesktop OpenWindowStationW GetTopWindow LoadImageW MsgWaitForMultipleObjects WindowFromPoint CharLowerA CharUpperW SetWindowLongW GetWindow DispatchMessageW ExitWindowsEx EqualRect PrintWindow GetMessageW EndPaint FillRect GetCursorPos GetUpdateRgn GetWindowDC BeginPaint SetCapture GetShellWindow RegisterClassA GetDCEx TranslateMessage GetKeyboardState GetClipboardData MenuItemFromPoint GetDC GetMenu RegisterClassExW GetMenuItemRect TrackPopupMenuEx SystemParametersInfoW GetClassNameW ReleaseDC GetMenuState DefWindowProcA DefMDIChildProcW SwitchDesktop GetMenuItemCount DefDlgProcA PostThreadMessageW DefMDIChildProcA HiliteMenuItem ToUnicode GetSystemMetrics GetMessageA GetWindowRect SetKeyboardState GetWindowThreadProcessId DefFrameProcW DefWindowProcW CallWindowProcW EndMenu CallWindowProcA SendMessageW GetUserObjectInformationW RegisterClassW GetUpdateRect |
| ADVAPI32.dll |
EqualSid
RegOpenKeyExW RegEnumKeyExW RegCloseKey GetLengthSid ConvertSidToStringSidW InitiateSystemShutdownExW CryptGetHashParam OpenProcessToken GetSidSubAuthority CryptAcquireContextW OpenThreadToken GetSidSubAuthorityCount GetTokenInformation RegCreateKeyExW CryptReleaseContext RegQueryValueExW CreateProcessAsUserW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetNamedSecurityInfoW LookupPrivilegeValueW CryptCreateHash ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityDescriptorSacl CryptDestroyHash AdjustTokenPrivileges RegSetValueExW CryptHashData IsWellKnownSid |
| SHLWAPI.dll |
StrStrIW
StrCmpNIW PathRenameExtensionW wvnsprintfA StrCmpNIA PathMatchSpecW PathRemoveBackslashW PathUnquoteSpacesW PathAddExtensionW PathCombineW SHDeleteKeyW PathSkipRootW SHDeleteValueW PathAddBackslashW PathFindFileNameW PathIsDirectoryW wvnsprintfW UrlUnescapeA PathIsURLW PathQuoteSpacesW StrStrIA PathRemoveFileSpecW |
| SHELL32.dll |
ShellExecuteW
SHGetFolderPathW CommandLineToArgvW |
| Secur32.dll |
GetUserNameExW
|
| ole32.dll |
StringFromGUID2
CLSIDFromString CoUninitialize CoCreateInstance CoInitializeEx |
| GDI32.dll |
SetViewportOrgEx
GdiFlush CreateDIBSection SetRectRgn SaveDC RestoreDC DeleteDC GetDeviceCaps DeleteObject SelectObject GetDIBits CreateCompatibleBitmap CreateCompatibleDC |
| WS2_32.dll |
#20
#18 getaddrinfo #17 #5 #111 #19 #3 WSASend WSAIoctl #4 WSAAddressToStringW #115 #22 #21 #2 #23 #112 #13 #16 freeaddrinfo WSAEventSelect #6 #1 |
| CRYPT32.dll |
CertDuplicateCertificateContext
CertEnumCertificatesInStore CertCloseStore CertOpenSystemStoreW CertDeleteCertificateFromStore PFXImportCertStore CryptUnprotectData PFXExportCertStoreEx |
| WININET.dll |
HttpAddRequestHeadersW
InternetSetStatusCallbackW GetUrlCacheEntryInfoW InternetQueryOptionA InternetSetOptionA InternetQueryOptionW HttpSendRequestW InternetReadFile InternetReadFileExA InternetQueryDataAvailable HttpSendRequestExW HttpSendRequestExA InternetCloseHandle InternetOpenA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA InternetCrackUrlA InternetConnectA HttpQueryInfoA |
| OLEAUT32.dll |
#8
#2 #9 #6 |
| NETAPI32.dll |
NetApiBufferFree
NetUserEnum NetUserGetInfo |