popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 426c87473cf3a1c9_ad905248ae8915310f4f54ea4fdbd093383798d1
Submit file
Filepath C:\Users\Default\ad905248ae8915310f4f54ea4fdbd093383798d1
Size 911.0B
Processes 1420 (WinDriverhostrefMonitordll.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 76ff273e029e38366efc08d069c37512
SHA1 1fd201c63a9d096d0cea2d80e9945755705f5ddc
SHA256 426c87473cf3a1c99086e97b58cdcbbfa0f360c95481362988dafc1e5282f8c4
CRC32 C4496D56
ssdeep 24:i7jfXXn9zJ67JdeuY+AFQBvymTq+vwVMI+EE:In9zKdeuYRFQBjoMI+EE
Yara None matched
VirusTotal Search for analysis
Name 32d28d6b6e4fc92e_590aee7bdd69b59b.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size 7.8KB
Processes 2552 (powershell.exe)
Type data
MD5 fcfec7061503838e2a6f9d638cce43d6
SHA1 b626364650c7c45ccde489a5df49dd65afe8c1c6
SHA256 32d28d6b6e4fc92e7dedb393d6a09cbf3248bc9ff55d5b93ebb244ac63bbd25a
CRC32 3E1AFD71
ssdeep 96:EtuCojGCPDXBqvsqvJCwoJtuCojGCPDXBqvsEHyqvJCworDtDHXyGlUVul:Etu6XoJtu6bHnorJTyY
Yara
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name 57d6f5e91674f16e_0a1fd5f707cd16ea89afd3d6db52b2da58214a6c
Submit file
Filepath C:\Windows\Tasks\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c
Size 354.0B
Processes 1420 (WinDriverhostrefMonitordll.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 a26ce5eeb388db361e0495407eade5b8
SHA1 fdb30377029714d4a178d9e0e46312873debabf9
SHA256 57d6f5e91674f16e83fb2ea5d34c6dcb2a5227559a58c7c9e108912ca5e17a59
CRC32 5443997F
ssdeep 6:zmFisdIAgH6AvZVXZXg0yRLycNi3hbDcOPMiv3aXYmw1RiIvcU12P3kagQn:6Fq9xVJXg0vcoxbDFMQUIvccPQn
Yara None matched
VirusTotal Search for analysis
Name 036214534c93de69_jx2t2hew2y66c90upmdtr.vbe
Submit file
Filepath C:\WinDriverhost\jX2t2hew2y66C90uPMdtR.vbe
Size 206.0B
Processes 1896 (shell.exe)
Type data
MD5 c3850cb6946190ad2bafa7667e6bf3bb
SHA1 78753e15c16d01ae2337804a5d60d229de4b683c
SHA256 036214534c93de69a875378641e45b08b84c3374663921c415943de92c1c6b7a
CRC32 0411F6E1
ssdeep 6:GmgwqK+NkLzWbHa/JUrFnBaORbM5nCsWEWgDLjd4Es:GmBMCzWLauhBaORbQCsDWgD9g
Yara None matched
VirusTotal Search for analysis
Name 7f6c86110cc6aacb_617403385cfa5793a54cc4029c1bf0ecc358174e
Submit file
Filepath C:\Windows\System32\NlsLexicons004a\617403385cfa5793a54cc4029c1bf0ecc358174e
Size 479.0B
Processes 1420 (WinDriverhostrefMonitordll.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 3a0552ce78c155576d25032ae24c35a6
SHA1 12f25594e6e780ec073cbe06e5e0635254598747
SHA256 7f6c86110cc6aacb9dffd52a87022b369f65f5a94421f44bf866140915ebeec5
CRC32 614E1033
ssdeep 12:/meMOyWvudZy1fz79EDQzRBdhKU35yctAPxu:/ZtyVdYpz7CDQNxz35Uxu
Yara None matched
VirusTotal Search for analysis
Name 84eef66b87beb899_e8aa3d0a77e909b354881c464e4c4a775ddb75b2
Submit file
Filepath C:\Windows\System32\nrpsrv\e8aa3d0a77e909b354881c464e4c4a775ddb75b2
Size 465.0B
Processes 1420 (WinDriverhostrefMonitordll.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 70043daf81b1005621d46ea38e4f698d
SHA1 f28ed7789848f690969d20313468b86c53d29979
SHA256 84eef66b87beb899899678dc5d8324ed7ffe79e95ff013c88e8d20896b280775
CRC32 A59D4756
ssdeep 12:siC4ThAPuUXZv/CVYjJyCBQu07PDM9BWwl5T1:xDThAPuQv6kyCmue4Mu1
Yara None matched
VirusTotal Search for analysis
Name cf7d1d9b49c50bdb_ad905248ae8915310f4f54ea4fdbd093383798d1
Submit file
Filepath C:\Program Files\Java\jre7\bin\dtplugin\ad905248ae8915310f4f54ea4fdbd093383798d1
Size 540.0B
Processes 1420 (WinDriverhostrefMonitordll.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 e154c0f5529da9c2d8dd4c7cd6b14449
SHA1 b852f901067d8a0c3b9fc7ba4cc8485f1534d1dd
SHA256 cf7d1d9b49c50bdb2478d9c4af72feabf71270e49c8924742659cea4f26927a4
CRC32 2F4DE168
ssdeep 12:X0e1LgPmT2guIpDBC7u5iQZlV6d7WIiMdEhjvCbWli6pn:X03P0TDpY71QZO7WAAvmcVp
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14___tmp_rar_sfx_access_check_29349546
Empty file or file not found
Filepath C:\WinDriverhost\__tmp_rar_sfx_access_check_29349546
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name b5ba786f4fb00635_windriverhostrefmonitordll.exe
Submit file
Filepath C:\WinDriverhost\WinDriverhostrefMonitordll.exe
Size 1.2MB
Processes 1896 (shell.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 2a941674030e4f45d7d8e5502b7cc621
SHA1 d863b1a629e74211c7a53225103cac248cce5583
SHA256 b5ba786f4fb00635bd80107b791ceeb5179fbcc713a88e7451c0f8807cb9ee59
CRC32 631B6D5C
ssdeep 24576:1HsazPFQJTIzdke2IFywtx7bBVKwXBEVn0nDtKe+4:R7zPeT+ks0k0VUDkZ
Yara
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • PE_Header_Zero - PE File Signature
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
VirusTotal Search for analysis
Name 99e1bc676198b431_fut2dsuxbp4lfmp.bat
Submit file
Filepath C:\WinDriverhost\fut2dsUXBP4lfMP.bat
Size 49.0B
Processes 1896 (shell.exe)
Type ASCII text, with no line terminators
MD5 5620a2d4df15f98d525877bb7bc3ae15
SHA1 a4b421185003a26a186177fc79824bdb2351f60a
SHA256 99e1bc676198b431bf2b035ae58256f468f8334c72b6eebf98bbbd98688cfd2f
CRC32 722A971B
ssdeep 3:I5mTAu8MTA9QMsRki:ILRzWMLi
Yara None matched
VirusTotal Search for analysis