Trojan-Spy.Win32.Zbot.bxf
High entropy .data sectionPE lacks signature record
SHA-2561bb332e7ac162256b093a281b4cef44f56b5892e6c89e67fdf4e72ff773f031d
MaleculeO(As)Md₃(Bi₂Si)
Evidence
⋯3 more rows
0x3000000000000000000000000000010000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯6 more rows
⋯5 more rows
0x9f000000000000000000000000000000000................
0xa00006d00000000000000000000a2000000.m..............
0xa100000be00330000040000000000630000....3........c..
0xa20ad00300da6730000ad0020e000000000..0..s.... .....
0xa3000780000a6df00ac0850cfa80000d000.x.......P......
⋯11 more rows
0xb29e0000534f465457415245204c4943454e..SOFTWARE LICEN
0xb2ae53452041475245454d454e540d0a0d0aSE AGREEMENT....
0xb2be2a2a2a20506c65617365207265616420*** Please read
0xb2ce7468697320656e746972652041475245this entire AGRE
0xb2de454d454e54202a2a2a0d0a0d0a4c4943EMENT ***....LIC
0xb2ee454e53453a0d0a0d0a2a205468697320ENSE:....* This
0xb2fe6c696d697465642075736520736f6674limited use soft
0xb30e77617265206c6963656e736520616772ware license agr
0xb31e65656d656e7420287468650d0a224147eement (the.."AG
0xb32e5245454d454e5422292069732061206cREEMENT") is a l
0xb33e6567616c2061677265656d656e742062egal agreement b
0xb34e65747765656e20796f752028224c4943etween you ("LIC
0xb35e454e53454522292c0d0a74686520656eENSEE"),..the en
0xb36e642d757365722c20616e6420626f6d65d-user, and bome
0xb37e2e636f6d20666f722074686520757365.com for the use
0xb38e206f662074686520526573746f726174 of the Restorat
⋯11 more rows
0xb46c20616772656520746f0d0a7468652074 agree to..the t
0xb47c65726d73206f66207468697320414752erms of this AGR
0xb48c45454d454e542c20616e6420796f7520EEMENT, and you
0xb49c68617665207265676973746572656420have registered
0xb4ac746869730d0a534f4654574152452c20this..SOFTWARE,
⋯5 more rows
0xb50c6d6174657269616c73292c20616c6f6ematerials), alon
0xb51c67207769746820796f75720d0a726563g with your..rec
0xb52c6569707420666f7220612066756c6c20eipt for a full
⋯5 more rows
0xbab5206d6179206e6f742075736520616e79 may not use any
0xbac5206c6963656e736520636f6465732066 license codes f
0xbad56f722074686520534f46545741524520or the SOFTWARE
0xbae5746861740d0a68617665206e6f742062that..have not b
0xbaf565656e20707572636861736564206672een purchased fr
⋯5 more rows