» photo_image_collection_album_001.jpg.exe
Overview
Analysis
File Details
Downloads (3)

photo_image_collection_album_001.jpg.exe

Matrix

The executable photo_image_collection_album_001.jpg.exe has been detected as malware by 37 anti-virus scanners. This is a setup program which is used to install the application. Accoriding to the detections, it is a variant of Zbot (Zeus), a trojan that attempts to steal confidential information (online credentials, and banking details) from a compromised computer and send it to online criminals via a command-and-control server. The file has been seen being downloaded from dc307.4shared.com and multiple other hosts.

File name:

Product:

Matrix

Description:

Matrix

Version:

1, 0, 0, 1

MD5:

358f1d1832d439b59e68a19570c2d316

SHA-1:

08d4496c99f650a2a8e74f5de67f42f8066f97f0

SHA-256:

9c0c102deb731a72e81aaabee156499d00ba40e56957a7f8f64c0e0fef5c39e2

Scanner detections:

37 / 68

Status:

Malware

Analysis date:

4/26/2024 5:23:59 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Trojan.GenericKD.1670039

953

Agnitum Outpost

Backdoor.Napolar

7.1.1

AhnLab V3 Security

Trojan/Win32.Xema

2014.06.09

Avira AntiVirus

TR/Spy.ZBot.shcvz

7.11.153.232

avast!

Win32:Zbot-TRI [Trj]

2014.9-140627

AVG

Zbot

2015.0.3431

Baidu Antivirus

Trojan.Win32.Injector

4.0.3.14627

Bitdefender

Trojan.GenericKD.1670039

1.0.20.890

Comodo Security

UnclassifiedMalware

18481

Dr.Web

Trojan.DownLoad3.32784

9.0.1.0178

Emsisoft Anti-Malware

Trojan.GenericKD.1670039

8.14.06.27.11

ESET NOD32

Win32/Injector.BDJX (variant)

8.9912

Fortinet FortiGate

W32/Injector.ACS!tr

6/27/2014

F-Prot

W32/Trojan2.OEEA

v6.4.7.1.166

F-Secure

Trojan.GenericKD.1670039

11.2014-27-06_6

G Data

Trojan.GenericKD.1670039

14.6.24

IKARUS anti.virus

Trojan-Spy.Zbot

t3scan.1.6.1.0

K7 AntiVirus

Trojan

13.1712333

Kaspersky

Backdoor.Win32.Napolar

14.0.0.3648

Malwarebytes

Spyware.Zbot.ED

v2014.06.27.11

McAfee

PWSZbot-FYZ!358F1D1832D4

5600.7087

Microsoft Security Essentials

Trojan:Win32/CeeInject

1.10600

MicroWorld eScan

Trojan.GenericKD.1670039

15.0.0.534

NANO AntiVirus

Trojan.Win32.Zbot.cxfqkh

0.28.0.60100

Norman

Small.SUIJ

11.20140627

nProtect

Trojan.GenericKD.1670039

14.06.08.01

Panda Antivirus

Trj/Zbot.M

14.06.27.11

Qihoo 360 Security

HEUR/Malware.QVM20.Gen

1.0.0.1015

Quick Heal

Backdoor.Napolar.r4

6.14.14.00

Reason Heuristics

Threat.Win.Reputation.IMP

14.7.14.11

Sophos

Troj/Spy-ACS

4.98

Total Defense

Win32/Tnega.AUJW

37.0.10986

Trend Micro House Call

TROJ_SPNR.09F414

7.2.178

Trend Micro

TROJ_SPNR.09F414

10.465.27

Vba32 AntiVirus

TrojanPSW.Fareit

3.12.26.0

VIPRE Antivirus

Trojan.Win32.Zbot.qu

30086

ViRobot

Trojan.Win32.U.Downloader.90112.A

2011.4.7.4223

File size:

192 KB (196,608 bytes)

Product version:

1, 0, 0, 1

Original file name:

Matrix.exe

File type:

Executable application (Win32 EXE)

Language:

French (France)

Common path:

C:\users\{user}\downloads\photo_image_collection_album_001.jpg.exe

File PE Metadata

Compilation timestamp:

4/30/2014 3:05:42 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

3072:wMm56KQtlQNChNbWbnlju4CiLCIeqLq5ZoLnyvKakQjUhFKp7JRnlly1fXYD:wB5Kl3h4Tlah/Z52UyhFKpdo1XE

Entry address:

0x5015

Entry point:

55, 8B, EC, 90, 8B, 0D, 90, A0, 40, 00, 33, C0, 85, C9, 74, 08, 56, E8, 82, 00, 00, 00, 90, 59, C3, C3, 50, E8, CB, C0, FF, FF, 50, 6A, 02, DC, 25, B0, 1C, 43, 00, DC, 0D, A8, 1C, 43, 00, DC, 05, 88, 1C, 43, 00, DF, 7D, F4, 8B, 45, F4, 8B, 4D, F8, 89, 45, EC, 89, 4D, F0, E8, 1D, 04, 00, 00, 83, C4, 0C, 8B, F0, E8, A1, 04, 00, 00, 8D, 45, EC, 50, E8, 8E, 00, 00, 00, 59, 50, 53, 8D, 45, D0, 6A, 14, 50, E8, BA, FF, FF, FF, 6A, 02, E8, F5, 03, 00, 00, 83, C4, 14, FF, 48, 1C, 50, FF, 15, E0, 67, 40, 00, 8D, 45... 
[+]

Developed / compiled with:

Microsoft Visual C++

Code size:

28 KB (28,672 bytes)

The file photo_image_collection_album_001.jpg.exe has been seen being distributed by the following 3 URLs.

https://dc307.4shared.com/download/wcxgQVfZce/.../TeBiNycKSMxRDxV

https://www.4shared.com/download/wcxgQVfZce/.../TeBiNycKSMxRDxV

http://www.disaronno.com/?a07u5od=82f9ce54874d7920f7fb88d

Remove photo_image_collection_album_001.jpg.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.