MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e5b440a826d14744df920514f027f0871f84292d83b95b731eadfe3165117448. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 3
| SHA256 hash: | e5b440a826d14744df920514f027f0871f84292d83b95b731eadfe3165117448 |
|---|---|
| SHA3-384 hash: | 97f99dd5ae507be4f38b6e6f6fa9be12a711c0f324e4f8dfd2bbe8fecdfb9ea96a63e5c5e68bc5e0f9d2d32d950dd424 |
| SHA1 hash: | 89198a1da32b1aedf70e9a113269b25c0abada82 |
| MD5 hash: | 4999aaea3e94b8cebf6f7c85c0e70f87 |
| humanhash: | fourteen-yankee-mississippi-don |
| File name: | zeSZwoAPWgbxgrv.dll |
| Download: | download sample |
| File size: | 894'464 bytes |
| First seen: | 2020-04-06 22:17:51 UTC |
| Last seen: | 2020-04-06 22:30:20 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 9dba226035a15226c159dcc33536645d |
| ssdeep | 6144:D90Xme25D0MIK1lqKdckQswhOB/uEpZ5WFFwGqpSwQLrWU6iQF45AdNcUq6ARLHx:G2jD0El2ZFgIFwGqEwQLqx4Qq1Z7 |
| Threatray | 39 similar samples on MalwareBazaar |
| TLSH | DA15E75BAE4384F3E7312A3FA6C21D0256147585E4E1298FB67DEE1C6E79E623C01ED0 |
| Reporter |  Racco42 |
| Tags: | dll ZLoader |
Intelligence
File Origin
# of uploads :
2
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Zbot
Status:
Malicious
First seen:
2020-04-06 19:27:30 UTC
File Type:
PE (Dll)
Extracted files:
14
AV detection:
23 of 31 (74.19%)
Threat level:
2/5
Verdict:
malicious
Similar samples:
+ 29 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
vbs dll e5b440a826d14744df920514f027f0871f84292d83b95b731eadfe3165117448
(this sample)
Delivery method
Other
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| AUTH_API | Manipulates User Authorization | advapi32.dll::SetNamedSecurityInfoA |
| MULTIMEDIA_API | Can Play Multimedia | ole32.dll::DllGetClassObject |
| WIN_BASE_API | Uses Win Base API | kernel32.dll::LoadLibraryA |
| WIN_CRED_API | Can Manipute Windows Credentials | advapi32.dll::CredIsMarshaledCredentialW |
| WIN_CRYPT_API | Uses Windows Crypt API | advapi32.dll::CryptGenKey |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.