home

happy_images_2014_jpg.exe

The executable happy_images_2014_jpg.exe has been detected as malware by 40 anti-virus scanners. Accoriding to the detections, it is a variant of Zbot (Zeus), a trojan that attempts to steal confidential information (online credentials, and banking details) from a compromised computer and send it to online criminals via a command-and-control server. The file has been seen being downloaded from silutesnaujienos.lt and multiple other hosts.
MD5:
aee27a31f07ab39bcc61c18b69d4f8a2

SHA-1:
47352b9c9dc85267ca4d7ecbfff2ad9214e549ff

SHA-256:
b82d14c0d34915d4aa5ff69eccbc54c90339e1475e30408dce15f82a09830e76

Scanner detections:
40 / 68

Status:
Malware

Analysis date:
11/23/2024 8:06:37 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.1669062
333

Agnitum Outpost
Trojan.Sharik
7.1.1

AhnLab V3 Security
Trojan/Win32.Fareit
2015.07.28

Avira AntiVirus
TR/Crypt.ZPACK.77461
8.3.1.6

Arcabit
Trojan.Generic.D1977C6
1.0.0.425

avast!
Win32:Napolar-BB [Trj]
2014.9-160308

AVG
Inject2
2017.0.2811

Baidu Antivirus
Trojan.Win32.Sharik
4.0.3.1638

Bitdefender
Trojan.GenericKD.1669062
1.0.20.340

Bkav FE
W32.VistarrdLTAAAAT.Trojan
1.3.0.6979

Comodo Security
UnclassifiedMalware
22875

Dr.Web
Trojan.PWS.Panda.5841
9.0.1.068

Emsisoft Anti-Malware
Trojan.GenericKD.1669062
8.16.03.08.07

ESET NOD32
Win32/TrojanDownloader.Zurgop.BK
10.12002

Fortinet FortiGate
W32/Sharik.SLF!tr
3/8/2016

F-Prot
W32/Trojan2.OEDP
v6.4.7.1.166

F-Secure
Trojan.GenericKD.1669062
11.2016-08-03_3

G Data
Trojan.GenericKD.1669062
16.3.25

IKARUS anti.virus
Trojan.Inject2
t3scan.1.9.5.0

K7 AntiVirus
Trojan-Downloader
13.207.16698

Kaspersky
Trojan.Win32.Sharik
14.0.0.548

Malwarebytes
Spyware.Zbot.ED
v2016.03.08.07

McAfee
Generic.ta
5600.6467

Microsoft Security Essentials
Trojan:Win32/Bagsu!rfn
1.1.11903.0

MicroWorld eScan
Trojan.GenericKD.1669062
17.0.0.204

NANO AntiVirus
Trojan.Win32.Inject.cxjjsw
0.30.24.2668

nProtect
Trojan.GenericKD.1669062
15.07.27.01

Panda Antivirus
Trj/WLT.A
16.03.08.07

Qihoo 360 Security
HEUR/Malware.QVM19.Gen
1.0.0.1015

Quick Heal
Trojan.CeeInject.A4
3.16.14.00

Rising Antivirus
PE:Trojan.Win32.Generic.16C5E473!382067827
23.00.65.16306

Sophos
Troj/Agent-AGTY
4.98

SUPERAntiSpyware
Trojan.Agent/Gen-Upatre
9278

Total Defense
Win32/Tnega.AUJA
37.1.62.1

Trend Micro House Call
TROJ_WC.F0BEE05L114
7.2.68

Trend Micro
TROJ_WC.F0BEE05L114
10.465.08

Vba32 AntiVirus
Backdoor.Napolar
3.12.26.4

VIPRE Antivirus
Trojan.Win32.Generic
42382

ViRobot
Trojan.Win32.S.Fareit.86016.A[h]
2014.3.20.0

Zillya! Antivirus
Trojan.Inject.Win32.73562
2.0.0.2317

File size:
84 KB (86,016 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\happy_images_2014_jpg.exe

File PE Metadata
Compilation timestamp:
5/1/2014 3:34:28 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:hjef3ZzHT4uHxKoG5zNP9Vf5XZJPUx+ZQVSzxXxgUDnG0Wl9i:VWSuH8tzV9d5qauUbGfvi

Entry address:
0x3671

Entry point:
55, 8B, EC, 89, 1D, F0, 60, 40, 00, BB, F2, 60, 40, 00, EB, 45, 90, 8D, 05, 00, 61, 40, 00, D1, E8, F6, DB, 89, 0D, 10, 61, 40, 00, 1B, DB, 83, E3, F2, 81, C3, 10, 01, 00, 00, 66, 89, 1D, 20, 61, 40, 00, 90, D3, 1D, 30, 61, 40, 00, 41, 00, F7, 90, 41, 00, 0D, 40, 61, 40, 00, 90, 41, 00, 3D, 50, 61, 40, 00, 90, B9, 60, 61, 40, 00, 00, FF, B8, 23, 60, 40, 00, 41, 00, D3, 90, 41, 00, D3, B9, FE, FF, FF, FF, B9, 60, 61, 40, 00, 56, 8B, D8, 57, 36, 8B, 78, 08, 90, 90, 40, 40, 6B, C0, 28, 3D, C8, 00, 00, 00, 7E...
 
[+]

Entropy:
6.9539

Developed / compiled with:
Microsoft Visual C++

Code size:
12 KB (12,288 bytes)

The file happy_images_2014_jpg.exe has been seen being distributed by the following 3 URLs.

http://silutesnaujienos.lt/?u1iitpmmlm9=33784b621de8fd

http://silutesnaujienos.lt/?2ztbuui0tluhh=44fdd4c4

http://www.disaronno.com/?bqea02s0e=992f26b2a7307b84141f4c4

Remove happy_images_2014_jpg.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.