Benign Download

Trojan-Spy.Win32.Zbot.ddi

High entropy .data sectionPE lacks signature record
SHA-2568d38603aa3a32dc6d07f639187fdc03a4d2984669ccde8b7e93b9efb4ec1d87d
MaleculeO(As)Md₃(Bi₂Si)

Evidence

High entropy .data section 0x19a0–0x1ae0
⋯5 more rows
0x19f000000000000000000000000000000000................
0x1a00000000f1d02dfb9c0029310000413100.....-...)1..A1.
0x1a10004c31000057310000653100007b3100.L1..W1..e1..{1.
0x1a200090310000a631000000000000c13100..1...1.......1.
0x1a3000d2310000e0310000eb310000f73100..1...1...1...1.
⋯11 more rows
.NET Bitmap.GetPixel per-pixel read 0x1b13–0x1e03
0x1b130000713200008832000098320000a832..q2...2...2...2
0x1b23000000000000fddd4372656174654861........CreateHa
0x1b336c66746f6e6550616c657474650066calftonePalette.f.
0x1b43476574506978656c00214244656c6574GetPixel.!BDelet
0x1b5365444300b3dc457874546578744f7574eDC...ExtTextOut
⋯43 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.