popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name e3b0c44298fc1c14_sbvc.exe
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\sbvc.exe
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 9ccdb4dd9ca37bdc_file_8.zip
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\extracted\file_8.zip
Size 5.6KB
Processes 8064 (7z.exe) 4456 (cmd.exe)
Type Zip archive data, at least v1.0 to extract
MD5 43acb7e888178d3af77ec7093c8ed4ed
SHA1 1525e143f9c7f2604fef3c7cfdbaea6dbdfa9469
SHA256 9ccdb4dd9ca37bdc006d807e4a0e024c15a74855c9dae6793857e3c00c3e086d
CRC32 CA24E537
ssdeep 96:V5YfhA5GtjmeeOwgt+nbxFHvViKZw8U7JBGt+lA44dmoAeWzBP3FHhC2GTj:V5Yfe5aeIt+nbxXTZE5lA4mV/qBP3FeX
Yara None matched
VirusTotal Search for analysis
Name b2ff3da1b93c4f8a_file_5.zip
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\extracted\file_5.zip
Size 5.3KB
Processes 6200 (7z.exe) 4456 (cmd.exe)
Type Zip archive data, at least v2.0 to extract
MD5 90e33f3facb6df48b0610a03cd0317d4
SHA1 ca18d619a277addf439a304d473879eacc8377d9
SHA256 b2ff3da1b93c4f8a0ab8ead2c1452c39e8c40cd0cc05243131b1e1759fb79e99
CRC32 A84CC949
ssdeep 96:yAd5c+4r0Kbg+n7xEmB49jUnJcAFRzal+KypCkaJFsA67h9iQEpfqT4i:yM5c+4rhlN94dUnJbFR2sqtGnJEA
Yara None matched
VirusTotal Search for analysis
Name 0223750a5a9ec5ff_payload.data
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\payload.data
Size 1.5MB
Processes 5580 (vpn_windows.exe) 4456 (cmd.exe)
Type Zip archive data, at least v2.0 to extract
MD5 588a01a28cf17e824c6453c7fddb865e
SHA1 68342bb44a6bba80a53a98fc5399ff92d3e3a8ab
SHA256 0223750a5a9ec5ff98afbc4f200f06571ed0edd989e55456202887eb891b1ed6
CRC32 80D49636
ssdeep 24576:Ryyh3bpm6f8XY8SQfo+z/8x23IIp2oSCIJY2EZLYYUaZ+c6LpTlL36SIah:NLbkg+z8grpGLJY2EZ0a8c6FTd6SIa
Yara None matched
VirusTotal Search for analysis
Name 2552e18a9acdbfac_file_6.zip
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\extracted\file_6.zip
Size 5.4KB
Processes 2848 (7z.exe) 4456 (cmd.exe)
Type Zip archive data, at least v1.0 to extract
MD5 8b88540155b12156df39bb4a2224617a
SHA1 b9d66a9c556c7f8b46fa48e57275ec06d1565f18
SHA256 2552e18a9acdbfaccec9f67ed35d63d937e85bad7d368072da1c04d298201d1c
CRC32 4957B25F
ssdeep 96:ubAd5c+4r0Kbg+n7xEmB49jUnJcAFRzal+KypCkaJFsA67h9iQEpfqT42CQ:ubM5c+4rhlN94dUnJbFR2sqtGnJE0D
Yara None matched
VirusTotal Search for analysis
Name f2ec898c9d41830c_svchost.cmd
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\svchost.cmd
Size 505.0B
Processes 5580 (vpn_windows.exe)
Type Little-endian UTF-16 Unicode text, with no line terminators
MD5 0c11c48e3ad68f0c63e7f3ac4f597931
SHA1 5198d7595227a237e6815d709814c547c7fda297
SHA256 f2ec898c9d41830c1f102f695ffc67f925429473221d7305c26e3ae58b13a95f
CRC32 1AF8A9A8
ssdeep 12:QUpCUFRjCTGIQLvpzwZHW57CVGrMLvTSBCMg78ArVL9:QUpCMwXepzsHW57CVGYTTJ78At9
Yara None matched
VirusTotal Search for analysis
Name 344f076bb1211cb0_7z.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\7z.exe
Size 458.0KB
Processes 5580 (vpn_windows.exe)
Type PE32+ executable (console) x86-64, for MS Windows
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
CRC32 085DB415
ssdeep 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name e79b8ae0e8c0517c_file_9.zip
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\extracted\file_9.zip
Size 1.5MB
Processes 4232 (7z.exe) 4456 (cmd.exe)
Type Zip archive data, at least v2.0 to extract
MD5 f5f0f23646a3424bc61258fb93cb380f
SHA1 a4890c9d141624c72676689e94e59f3a472a92d0
SHA256 e79b8ae0e8c0517c4c58c9a2100b8c21c923ef6ee4bcbec50b26cdda9121905d
CRC32 B782050C
ssdeep 24576:D8Ea1RY0FhQMhqO1wkGTNC6mvjlmUvnA/I8OFY4dVo4fh5N6wf79u/uxX4ekRqMg:4PnhQMhqO1OmLlmJ/IzYmfz46Q8CMM2V
Yara None matched
VirusTotal Search for analysis
Name 987682fb4efb6010_file_1.zip
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\extracted\file_1.zip
Size 4.8KB
Processes 5260 (7z.exe) 4456 (cmd.exe)
Type Zip archive data, at least v2.0 to extract
MD5 e132ed1822f3373ec7d7f30f48933e61
SHA1 2a37bc7edd8f67078985ee966c93a310f578c7b8
SHA256 987682fb4efb60101e5124ae4356caadee8c7661b6c324c81901c73f19154e77
CRC32 B460F970
ssdeep 96:1R90/zDoEn13MRQ644NU4TtuKan2aNked6VugbXstgM+hbX:1D0YE9MRhhNU049d6VugEveX
Yara None matched
VirusTotal Search for analysis
Name 34ad9bb80fe8bf28_7z.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\7z.dll
Size 1.6MB
Processes 5580 (vpn_windows.exe)
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
CRC32 D5226149
ssdeep 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • IsDLL - (no description)
  • Microsoft_Office_File_Zero - Microsoft Office File
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 850743df16a02368_file_7.zip
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\extracted\file_7.zip
Size 5.5KB
Processes 4960 (7z.exe) 4456 (cmd.exe)
Type Zip archive data, at least v2.0 to extract
MD5 b1033d2c18a287e2fde5389affd2cf82
SHA1 47c89242cbe754fb0040ed8082fc93da0a214001
SHA256 850743df16a02368700de70efced3cecf5ca3436f3d7445be643fc40323a3fac
CRC32 F8DC0C4B
ssdeep 96:O5YfhA5GtjmeeOwgt+nbxFHvViKZw8U7JBGt+lA44dmoAeWzBP3FHhC2GTy:O5Yfe5aeIt+nbxXTZE5lA4mV/qBP3FeO
Yara None matched
VirusTotal Search for analysis
Name cd009b48b0f86a7f_file_2.zip
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\extracted\file_2.zip
Size 5.0KB
Processes 4120 (7z.exe) 4456 (cmd.exe)
Type Zip archive data, at least v1.0 to extract
MD5 4ae03ed5e395d372854f10f113e14767
SHA1 3a6590bf0739088ea66e56ff8fd494e7ef1c46b5
SHA256 cd009b48b0f86a7f6cc9f062e13b6680616e6026d68fa3cebc1824dc7e4aff35
CRC32 01C17181
ssdeep 96:gR90/zDoEn13MRQ644NU4TtuKan2aNked6VugbXstgM+hbk:gD0YE9MRhhNU049d6VugEvek
Yara None matched
VirusTotal Search for analysis
Name a410da69cdcb9873_file_3.zip
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\extracted\file_3.zip
Size 5.1KB
Processes 6764 (7z.exe) 4456 (cmd.exe)
Type Zip archive data, at least v2.0 to extract
MD5 b097eaca95d24f4d015a813454eb040b
SHA1 e6000ea531a612c401c108c41a9dd3ec522bdcf8
SHA256 a410da69cdcb987361b4524be0325e2be36ed0a767057c783f556b18682c8308
CRC32 C89404B1
ssdeep 96:Qk/4+PZYoffOXhX+Dx6iWWACZKHwjuSXpzY8lUbZxtSYHx27Lygl:Qkw+PZPWXhX+DGCZ8yuV4YHg7Dl
Yara None matched
VirusTotal Search for analysis
Name 7159c79e34345a08_file_4.zip
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\extracted\file_4.zip
Size 5.2KB
Processes 7664 (7z.exe) 4456 (cmd.exe)
Type Zip archive data, at least v1.0 to extract
MD5 b6f4fc8d626ae943b410ac8dd73d43ec
SHA1 0d9ff517c325e1e27544011dabfced475bcb3dcb
SHA256 7159c79e34345a08d9131f7733228bc6aec2a55058cb4a457734601c1eda8079
CRC32 3231CD68
ssdeep 96:Rk/4+PZYoffOXhX+Dx6iWWACZKHwjuSXpzY8lUbZxtSYHx27Lygc:Rkw+PZPWXhX+DGCZ8yuV4YHg7Dc
Yara None matched
VirusTotal Search for analysis
Name f825dd89181e7435_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 4764 (powershell.exe)
Type data
MD5 61d3b003e73f968491bb9de05318fcbd
SHA1 abb40732bf72a072c5b176449fdb8f1c56383e03
SHA256 f825dd89181e743525684aff8d99cc6d78046e461147c33b6f7a182b98c58ea9
CRC32 76116DE9
ssdeep 96:wtuCiGCPDXBqvsqvJCwoNtuCiGCPDXBqvsEHyqvJCworc7HwxGlUVul:wt7XoNt7bHnorXxY
Yara
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name 83ebb1b639e393bd_antiscan.data
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\extracted\antiscan.data
Size 2.0MB
Processes 8064 (7z.exe) 4456 (cmd.exe)
Type Non-ISO extended-ASCII text, with very long lines, with no line terminators
MD5 7e9516d8bcc00feb306ae9fd2831bfe4
SHA1 beb1376aa7155c9c90806d6f3d070f820a3071f1
SHA256 83ebb1b639e393bd3b994bfcd8c702f3ba284ba743b8cc6dee0916ba995c63ae
CRC32 8B3E9D58
ssdeep 24576:CyZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xM:A9kqGu7okoZscCnf0/Zs9l
Yara
  • NPKI_Zero - File included NPKI
VirusTotal Search for analysis
Name 1c1a40b1e2b8df54_downloader.exe
Submit file
Filepath c:\users\test22\appdata\local\temp\7zipsfx.000\downloader.exe
Size 13.0KB
Processes 8408 (7z.exe) 4456 (cmd.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 12d20870d398418e3d026290028c33ad
SHA1 252cfd15a4868dfdd53db56ac23ca0a1dfb2ed05
SHA256 1c1a40b1e2b8df54103adf62ce5248393c8ec2f7a9ac5e7d258b178623c253b8
CRC32 512B5E1C
ssdeep 384:L2i4ULC+Sd73W3Tt5KmbZS5uLGZoptYcFSVc03K:0ULC+Sd73W3x5RbAVZ8tYcFSVc6K
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
VirusTotal Search for analysis