popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 5f01d433d0a6d3ee_secur.exe
Submit file
Filepath C:\Users\test22\AppData\Roaming\Adobe\secur.exe
Size 1.1MB
Processes 544 (DCRatBuild.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 697eb5426e9006fac2ae1354277991f1
SHA1 3c52a21952a463c70da6b660d007ee06f665c98a
SHA256 5f01d433d0a6d3eec89b7823cd3639f00aa765ccb1329f327fc194611d45f457
CRC32 FD2B28A9
ssdeep 24576:Ix/Q6dREkbInvJKkoDn+D5B61Uq7rVgSC+4:I/bInC2qKC
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Malicious_Packer_Zero - Malicious Packer
VirusTotal Search for analysis
Name 33cb239b89414a5c_rxfjkhuhhjyh.bat
Submit file
Filepath C:\Users\test22\AppData\Roaming\Adobe\rXFJKHUhhJYH.bat
Size 139.0B
Processes 544 (DCRatBuild.exe)
Type ASCII text, with no line terminators
MD5 af5381740b086774e8138d0395bb4269
SHA1 8939b39355dfeb18af874ac0451efd2b2d878bc4
SHA256 33cb239b89414a5c9aab1ec6f47e1c536aab0023a02bfac9e32c91bc617cb3f6
CRC32 10A17FED
ssdeep 3:BtkQX0iFQNBZwXD9so3KRfyM1K7eB/k+7W34hebJNAKyMhF7FKD:BtaFTStuH1jhRiI36BY
Yara None matched
VirusTotal Search for analysis
Name ce66a221f82b8a26_96094160f8fe35082122a9a077d9edee0a3e9a23
Submit file
Filepath C:\Windows\System32\slui\96094160f8fe35082122a9a077d9edee0a3e9a23
Size 807.0B
Processes 2828 (secur.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 d57d57e4a94bcf4ef430379e10cd5580
SHA1 f25c5857e14bcf25896a57a402f98b08c3c45fe5
SHA256 ce66a221f82b8a2630a5be5c9072b036159eda5b59bacbbd1fde928bf752f47a
CRC32 1D0F1E9D
ssdeep 24:2Pu68va/ue8TjUCvtCjJeNVWVjXu4WsMD/kTjxfKYX:2PuVr1TjUUaIWdgTAlSYX
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14___tmp_rar_sfx_access_check_5355687
Empty file or file not found
Filepath C:\Users\test22\AppData\Roaming\Adobe\__tmp_rar_sfx_access_check_5355687
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 2e318586883a42b6_7a0fd90576e08807bde2cc57bcf9854bbce05fe3
Submit file
Filepath C:\Windows\Performance\WinSAT\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
Size 330.0B
Processes 2828 (secur.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 a47e2e94edd68fedbb98e538fdaad28b
SHA1 36feaf6f5f756a1a8c97bfee9d858ecce96a7701
SHA256 2e318586883a42b6711576488e74b253ed3936da34bc5d707366be6f42187168
CRC32 E18FA55E
ssdeep 6:UujYdN1UlcRWyVEq/QuNIAVxKZddTTewoqH7WkcO8fa8wlVrbhox:UucP+qfNcdTTdoq7cTfa8wlpbex
Yara None matched
VirusTotal Search for analysis
Name a6f563d5413a6ebf_7a0fd90576e08807bde2cc57bcf9854bbce05fe3
Submit file
Filepath C:\Windows\setuperr\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
Size 122.0B
Processes 2828 (secur.exe)
Type ASCII text, with no line terminators
MD5 e173c8942cc177b4b19354c0d3c7432b
SHA1 755e63588f9195db4e83ed05af3c4abf1d7979f4
SHA256 a6f563d5413a6ebf4cc7fd056181458ba1d5cece75720e8ff17ca508982a67b5
CRC32 F03B778C
ssdeep 3:VNi0taNiiFLziitza3siL/lJH6VavlyIn:VNi0ta0ihzxt23sUlVVyI
Yara None matched
VirusTotal Search for analysis
Name 13440970a98a6972_4a1145983886ca6e83e0c602fdf4d92ac60ad979
Submit file
Filepath C:\Users\test22\4a1145983886ca6e83e0c602fdf4d92ac60ad979
Size 916.0B
Processes 2828 (secur.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 52ee80c7d2e1af06e3fb91ac128125e9
SHA1 7a3115947a272077a91dd22f4e80b7f7dc620ca8
SHA256 13440970a98a697202bdc473dfc4b5012759740384de1712ae07a377817c1b37
CRC32 4543CE56
ssdeep 12:4csBuPcKFczJD2+CKbwnOMJTZ9rqrK0wLdrGdoNTu9LS3MJmLMg0vnUGWjfKxJlV:4c4uOmxJX10+RS1S33b0PUGkFpd9Bm
Yara None matched
VirusTotal Search for analysis
Name 10b4683d9d995a55_886983d96e3d3e31032c679b2d4ea91b6c05afef
Submit file
Filepath C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\886983d96e3d3e31032c679b2d4ea91b6c05afef
Size 372.0B
Processes 2828 (secur.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 99547e3505fda3225aada90cdca12191
SHA1 511e7e1b87a35eed1b89a0d62ea16b549ad3de93
SHA256 10b4683d9d995a5552e64d7993cc1871de96340362c15b0fceecd2835475bcfe
CRC32 477A1D7E
ssdeep 6:mmW2hvTxtz4q4oV2mUWrVkTk8F/G+giRhziUpfkTqoabBtwUls/8F2oIlvkcFMoF:mEhL7z4q4IfUWrVkTkogiRhziwfyXabw
Yara None matched
VirusTotal Search for analysis
Name 117ba8ad4fd73fc5_7a0fd90576e08807bde2cc57bcf9854bbce05fe3
Submit file
Filepath C:\Sandbox\test22\DefaultBox\drive\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
Size 675.0B
Processes 2828 (secur.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 4a8d0b0ae133ee86d4cb06387a00bf20
SHA1 cadc1b5056a152a8c6fa516caf9feb015f52832e
SHA256 117ba8ad4fd73fc5d592aebddfed5284026a5ad284ad2c0c37d8255a5ea924eb
CRC32 370A7F16
ssdeep 12:HCSUoNoriyiAOS/21TOfE/5JC0Ij2AmH51BNd+dQCPhzbzuddQoCj16jW:H9UiowA6NTjtBNmQCPtzW+oO6q
Yara None matched
VirusTotal Search for analysis
Name b060144a23fb0872_8zymehus91wn1cjuxl.vbe
Submit file
Filepath C:\Users\test22\AppData\Roaming\Adobe\8ZymEhuS91wN1CjUXL.vbe
Size 201.0B
Processes 544 (DCRatBuild.exe)
Type data
MD5 ada44290ae80330afa0d0826a51c429f
SHA1 fd3f7f713074a46d236a458052e8bb9b1e0d569b
SHA256 b060144a23fb0872df4683c46034c1723cb06baee25e9f057e5a433f5b059ce1
CRC32 4A5DEED6
ssdeep 6:GJ2wqK+NkLzWbHK/818nZNDd3RL1wQJRZ7Lrt:GJ7MCzWLKG4d3XBJr7Lrt
Yara None matched
VirusTotal Search for analysis