MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 81a9eb444ffc7c5a700d4da6198c2f929d0e312d38667b9d3e29740eccabca3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 3
| SHA256 hash: | 81a9eb444ffc7c5a700d4da6198c2f929d0e312d38667b9d3e29740eccabca3f |
|---|---|
| SHA3-384 hash: | dcfc7d274eb2438ae5f3ef9d0ebfc1d762680baa8ef0ca51116ccfff010b70839a64452f23a26bee1f80c4d96de4ce1c |
| SHA1 hash: | dabfb88a8dea9c8c258be021a3d190e145a65847 |
| MD5 hash: | fcb76558dbf86a26c4bdd2811d5d06b6 |
| humanhash: | batman-sad-earth-zulu |
| File name: | sRjbEZvCFOESXQJ.dll |
| Download: | download sample |
| File size: | 724'992 bytes |
| First seen: | 2020-04-02 09:15:45 UTC |
| Last seen: | 2020-04-02 09:44:24 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 6d3a0c4e8389ff31bf2c232263c1eba0 |
| ssdeep | 6144:7QihZtNT7DIs9m6phIGNM0RkjOorkHP7A0WI/+DIvaWx3C/opWemqQu7FAxtS:7QihlvI2arA7w3JW9CMWhA |
| Threatray | 41 similar samples on MalwareBazaar |
| TLSH | 74F4172A660384EBE7753A30E7E60E179941B1D5E4300C8F7A7E9E9C7E90B917C09EC5 |
| Reporter |  Racco42 |
| Tags: | dll ZLoader |
Intelligence
File Origin
# of uploads :
2
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Zbot
Status:
Malicious
First seen:
2020-04-01 20:13:07 UTC
File Type:
PE (Dll)
AV detection:
25 of 31 (80.65%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 31 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
vbs dll 81a9eb444ffc7c5a700d4da6198c2f929d0e312d38667b9d3e29740eccabca3f
(this sample)
Delivery method
Other
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| AUTH_API | Manipulates User Authorization | advapi32.dll::GetExplicitEntriesFromAclA |
| COM_BASE_API | Can Download & Execute components | ole32.dll::CoAddRefServerProcess |
| MULTIMEDIA_API | Can Play Multimedia | winmm.dll::joyGetNumDevs winmm.dll::midiOutGetNumDevs winmm.dll::sndPlaySoundA winmm.dll::timeGetDevCaps |
| SECURITY_BASE_API | Uses Security Base API | advapi32.dll::GetSecurityDescriptorControl |
| WIN_BASE_API | Uses Win Base API | kernel32.dll::LoadLibraryA |
| WIN_BASE_IO_API | Can Create Files | version.dll::GetFileVersionInfoSizeA |
| WIN_USER_API | Performs GUI Actions | user32.dll::CsrBroadcastSystemMessageExW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.