home

my-pretty-spring-photo-shared-img0213.jpg.exe

Histogram Application

The executable my-pretty-spring-photo-shared-img0213.jpg.exe has been detected as malware by 32 anti-virus scanners. This is a setup program which is used to install the application. Accoriding to the detections, it is a variant of Zbot (Zeus), a trojan that attempts to steal confidential information (online credentials, and banking details) from a compromised computer and send it to online criminals via a command-and-control server. The file has been seen being downloaded from catalog.chaosium.com.
Product:
Histogram Application

Description:
Histogram

Version:
1, 0, 0, 1

MD5:
5100361336aa14a4bc920f0796ad2bfd

SHA-1:
2a7aaaa00063e0a86420e5ff6c7b71df18f632a6

SHA-256:
d2083f87452075ed0dc4ff4ee9ce607fb11df6f1b1b0b58e2a6961ef2295fee2

Scanner detections:
32 / 68

Status:
Malware

Analysis date:
4/20/2024 1:58:24 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Strictor.53491
349

Agnitum Outpost
Backdoor.Napolar
7.1.1

AhnLab V3 Security
Spyware/Win32.Zbot
2015.03.27

avast!
Win32:CeeInject-AU [Trj]
2014.9-160221

AVG
Generic35
2017.0.2827

Baidu Antivirus
Trojan.Win32.Injector
4.0.3.16221

Bitdefender
Gen:Variant.Strictor.53491
1.0.20.260

Bkav FE
W32.FabotlesLTAAX.Trojan
1.3.0.6379

Comodo Security
UnclassifiedMalware
21554

Dr.Web
Trojan.PWS.Panda.5841
9.0.1.052

Emsisoft Anti-Malware
Gen:Variant.Strictor.53491
8.16.02.21.10

ESET NOD32
Win32/Injector.BAHG (variant)
10.11385

Fortinet FortiGate
W32/Kryptik.QJ!tr
2/21/2016

F-Secure
Gen:Variant.Strictor.53491
11.2016-21-02_1

G Data
Gen:Variant.Strictor.53491
16.2.25

IKARUS anti.virus
Trojan.Win32.Napolar
t3scan.1.8.6.0

K7 AntiVirus
Trojan
13.202.15399

Kaspersky
HEUR:Trojan.Win32.Generic
14.0.0.628

Malwarebytes
Trojan.Downloader.BCM
v2016.02.21.10

McAfee
Necurs-FAUT!5100361336AA
5600.6483

Microsoft Security Essentials
Trojan:Win32/Napolar.A
1.1.11502.0

MicroWorld eScan
Gen:Variant.Strictor.53491
17.0.0.156

NANO AntiVirus
Trojan.Win32.Panda.cwblem
0.30.8.659

Norman
Upatre.FB
11.20160221

Panda Antivirus
Trj/CI.A
16.02.21.10

Qihoo 360 Security
Win32/Trojan.Multi.daf
1.0.0.1015

Quick Heal
TrojanPWS.Zbot.AP4
2.16.14.00

Sophos
Troj/Fondu-W
4.98

Trend Micro House Call
TROJ_SPNR.09CP14
7.2.52

Trend Micro
TROJ_SPNR.09CP14
10.465.21

VIPRE Antivirus
Trojan-Ransom.Win32.Crypren.pql
38816

Zillya! Antivirus
Trojan.Zbot.Win32.156440
2.0.0.2118

File size:
166.9 KB (170,856 bytes)

Product version:
1, 0, 0, 1

Copyright:
Copyright (C) 2001

Original file name:
Histogram.EXE

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\my-pretty-spring-photo-shared-img0213.jpg.exe

File PE Metadata
Compilation timestamp:
3/12/2014 6:57:58 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:A/2J+n2Y1zwIDNsPKxS2xqxbf+pW2AU1Yi7mR2Ce6Ynqnf8qMBl:AUY1zwIOPKlobf+f1Ve2WYnqnf8qMBl

Entry address:
0x2CD0

Entry point:
55, 8B, EC, 6A, FF, 68, 70, 47, 40, 00, 68, 56, 2E, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, 34, 42, 40, 00, 59, 83, 0D, 30, 62, 40, 00, FF, 83, 0D, 34, 62, 40, 00, FF, FF, 15, 30, 42, 40, 00, 8B, 0D, 24, 62, 40, 00, 89, 08, FF, 15, 2C, 42, 40, 00, 8B, 0D, 20, 62, 40, 00, 89, 08, A1, 28, 42, 40, 00, 8B, 00, A3, 2C, 62, 40, 00, E8, 16, 01, 00, 00, 39, 1D, 40, 60, 40, 00, 75, 0C, 68, 52, 2E, 40, 00, FF, 15, 24, 42...
 
[+]

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
12 KB (12,288 bytes)

The file my-pretty-spring-photo-shared-img0213.jpg.exe has been seen being distributed by the following URL.

http://catalog.chaosium.com/?ahi535ee1kre=22cd0c0582143e343

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.