popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name e005946fb92cc1ba_b75386f1303e64d8139363b71e44ac16341adf4e
Submit file
Filepath C:\Windows\System32\hidserv\b75386f1303e64d8139363b71e44ac16341adf4e
Size 80.0B
Processes 2984 (secur.exe)
Type ASCII text, with no line terminators
MD5 ca7c0c29840d2deefe131cc716476daa
SHA1 0fddf708344ec828ff6281730d12dca6c3c4ff92
SHA256 e005946fb92cc1bae3d4ceece1a646dcb5e2ab394a35318075558086e1ca99c2
CRC32 2D257596
ssdeep 3:qdNLVzrE7imMg3QcAj1d9:0NxEqGG1d9
Yara None matched
VirusTotal Search for analysis
Name 5f01d433d0a6d3ee_secur.exe
Submit file
Filepath C:\Users\test22\AppData\Roaming\Adobe\secur.exe
Size 1.1MB
Processes 2480 (DCRatBuild.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 697eb5426e9006fac2ae1354277991f1
SHA1 3c52a21952a463c70da6b660d007ee06f665c98a
SHA256 5f01d433d0a6d3eec89b7823cd3639f00aa765ccb1329f327fc194611d45f457
CRC32 FD2B28A9
ssdeep 24576:Ix/Q6dREkbInvJKkoDn+D5B61Uq7rVgSC+4:I/bInC2qKC
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Malicious_Packer_Zero - Malicious Packer
VirusTotal Search for analysis
Name 33cb239b89414a5c_rxfjkhuhhjyh.bat
Submit file
Filepath C:\Users\test22\AppData\Roaming\Adobe\rXFJKHUhhJYH.bat
Size 139.0B
Processes 2480 (DCRatBuild.exe)
Type ASCII text, with no line terminators
MD5 af5381740b086774e8138d0395bb4269
SHA1 8939b39355dfeb18af874ac0451efd2b2d878bc4
SHA256 33cb239b89414a5c9aab1ec6f47e1c536aab0023a02bfac9e32c91bc617cb3f6
CRC32 10A17FED
ssdeep 3:BtkQX0iFQNBZwXD9so3KRfyM1K7eB/k+7W34hebJNAKyMhF7FKD:BtaFTStuH1jhRiI36BY
Yara None matched
VirusTotal Search for analysis
Name c9f6ff469e63da66_59U2oN9mIe.bat
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\59U2oN9mIe.bat
Size 258.0B
Processes 2984 (secur.exe) 1520 (cmd.exe)
Type DOS batch file, ASCII text, with CRLF line terminators
MD5 6995350ff6f1a323aeb8c537afd954c2
SHA1 ecf33f9746a88467064418296a366282d1914f6d
SHA256 c9f6ff469e63da66e78f228318621d2056864702595cfeb730fc91f9e57357e9
CRC32 D3813F1F
ssdeep 6:hCijTg3Nou11r2mQpcLJ23fkEPeqKOZG1mQpcLJ23ftwL:HTg92OLMMEPEOLM1wL
Yara None matched
VirusTotal Search for analysis
Name c071f2a3a6a443b3_57b24ea53652863d6d0f7e96c78ebb64169c9c0e
Submit file
Filepath C:\Users\test22\AppData\Roaming\Adobe\secur\57b24ea53652863d6d0f7e96c78ebb64169c9c0e
Size 471.0B
Processes 2984 (secur.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 a696722e2db608bf15260c40fd7e12ce
SHA1 43e8c07b02a226ae29f08e7a311f172c5af1b1e3
SHA256 c071f2a3a6a443b32526245c6dcaf5f52256da95ffd63b7bda6388ee80afdc60
CRC32 92E69CFA
ssdeep 12:vJfTvWD+RVXUoNSnnZkg8eUjAlK375W9cMgJhaHBdJ5t:VNm5ZTUP39J6pz
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14___tmp_rar_sfx_access_check_15668234
Empty file or file not found
Filepath C:\Users\test22\AppData\Roaming\Adobe\__tmp_rar_sfx_access_check_15668234
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 5c674d154bad91c8_kq96EdrlGr
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\kq96EdrlGr
Size 25.0B
Processes 2984 (secur.exe)
Type ASCII text, with no line terminators
MD5 5e9aad49ab0deaea4ee87fdd94a35150
SHA1 e240839bb1645b316a0f1b4cda1cac17b3c9950a
SHA256 5c674d154bad91c84d9b1fe2b7944b6a5a45eaafbf862800ab8e06a04a772a2f
CRC32 41BE60F5
ssdeep 3:dAaFE3iP5jn:dnP9n
Yara None matched
VirusTotal Search for analysis
Name b060144a23fb0872_8zymehus91wn1cjuxl.vbe
Submit file
Filepath C:\Users\test22\AppData\Roaming\Adobe\8ZymEhuS91wN1CjUXL.vbe
Size 201.0B
Processes 2480 (DCRatBuild.exe)
Type data
MD5 ada44290ae80330afa0d0826a51c429f
SHA1 fd3f7f713074a46d236a458052e8bb9b1e0d569b
SHA256 b060144a23fb0872df4683c46034c1723cb06baee25e9f057e5a433f5b059ce1
CRC32 4A5DEED6
ssdeep 6:GJ2wqK+NkLzWbHK/818nZNDd3RL1wQJRZ7Lrt:GJ7MCzWLKG4d3XBJr7Lrt
Yara None matched
VirusTotal Search for analysis
Name 98e04fbb3258762c_560854153607923c4c5f107085a7db67be01f252
Submit file
Filepath C:\Windows\System32\NlsData004e\560854153607923c4c5f107085a7db67be01f252
Size 982.0B
Processes 2984 (secur.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 90d863b4feafd9fb1254d6110fddb12d
SHA1 38641d67d50273db6515857ea8a57ebed47f4e1d
SHA256 98e04fbb3258762c1090ffcf14a895a0b7d7c17ab5db61e6e6a78f89f269959d
CRC32 5F0FE39A
ssdeep 24:JPRiL0HUPs3EGEsBV3T9WXWBMdEcamZM6Npwzsdh:m4HT3RPx3MEcj9rGsH
Yara None matched
VirusTotal Search for analysis