popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 2f7f8fc05dc4fd0d_UAC.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nsr799E.tmp\UAC.dll
Size 14.5KB
Processes 1608 (lv.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
CRC32 1FE27A66
ssdeep 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 876d2acfb61ec9bc_fip.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\mystax\fip.exe
Size 236.0KB
Processes 1608 (lv.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 50b69d1c36e21c84ede482d12e8f9ad7
SHA1 9dc4c98e251511a07720218f2eb49e23c12d85d8
SHA256 876d2acfb61ec9bc313964fd731386977e65949f95ac50a5181700742fa30172
CRC32 015BB434
ssdeep 6144:ijV4w6FzLSw6qSgT3j4TsFu3nvqGWhR3TZ:RTNLP/Sgv4ow3rO
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name b198d0e88e797b0a_B
Submit file
Filepath C:\Users\test22\AppData\Roaming\B
Size 980.4KB
Type ASCII text, with very long lines, with CRLF, CR, LF line terminators
MD5 914458e3e66e9f69c87126bca4949ca5
SHA1 e10d03f5ebef0e4fee8cbdfe0b0e9d802bc956dd
SHA256 b198d0e88e797b0a40dce89f6788d04474531b82d80c10f72468ab23d7e8e015
CRC32 55EBD9DA
ssdeep 12288:y/gZTL9y7LsI8Vgr6IQl0upoQeREVVOyjBMNfJQRzIXTlmf2mnFZdCWWm9ySG/2l:yfjcKsZ2Ewya9+
Yara
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • NPKI_Zero - File included NPKI
VirusTotal Search for analysis
Name c7434db6c198b161_howkit.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\mystax\howkit.exe
Size 895.6KB
Processes 1608 (lv.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 44971a02c6c0ab3f1d82b53ac1a1ec15
SHA1 528e145d503f30982198c61c3ab975b40920d631
SHA256 c7434db6c198b161daffa9be3b0b754d7cc6aad96826b28e7b612b7b8616a6db
CRC32 432C0C97
ssdeep 24576:COx/Q60rj44bWzG/A7IgQN5p1E0a84rTdov:/I60/CKYMbMBo
Yara
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 13d82005c59757ce_gettando.flv
Submit file
Filepath C:\Users\test22\AppData\Roaming\Gettando.flv
Size 422.0B
Processes 2100 (howkit.exe)
Type ASCII text, with CRLF line terminators
MD5 fe34093572482214dbb703aee6892a48
SHA1 09125a0d830c14fc9aab9ffca4eb7540b4a2db55
SHA256 13d82005c59757cef5358c1a5df24dc01c8da5f7348fecec2774c6386ff77e28
CRC32 817CEAFB
ssdeep 6:jfVcvf5tHBwsByyDdkXHqFKNvw+Rn7gyt3sME2ZKMl4JI2KBNhzHyWdNEojBw0r:mrhwsByyB8jvwEB6mKMlt2OhhfE4S0r
Yara None matched
VirusTotal Search for analysis
Name 810d8e7929c40187_vergogna.flv
Submit file
Filepath C:\Users\test22\AppData\Roaming\Vergogna.flv
Size 872.8KB
Processes 2100 (howkit.exe)
Type data
MD5 596ed81890c7c3af9b42a893268d3082
SHA1 35c1df1d7ecf5cfdbb44f6acdea80c0fdd050a49
SHA256 810d8e7929c40187874bead6846490a1c526a4208d6fe960d37c78537e857d48
CRC32 214B2E2D
ssdeep 12288:MpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:MT3E53Myyzl0hMf1tr7Caw8M01
Yara
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
VirusTotal Search for analysis
Name 338287ddb5fdbf0f_adprovider.dll
Submit file
Filepath C:\Program Files (x86)\foler\olader\adprovider.dll
Size 48.5KB
Processes 1608 (lv.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 f981199c82a40cf638d313c4498ecab9
SHA1 9f2ba1092a90b048aaf51304d139018e13144f3b
SHA256 338287ddb5fdbf0f7540dac8ae8a3f02643f7b45f3b401a9dfa6447e39043049
CRC32 BB3860CF
ssdeep 768:Amge8Q4UsMhIrA1pifdlIGHmizKO6EjjKRyGlqesRtgjEDy:AG548IrA1pifdRHmizKiWRPlqPjy
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 804d012771972312_piu.flv
Submit file
Filepath C:\Users\test22\AppData\Roaming\Piu.flv
Size 8.0KB
Processes 2100 (howkit.exe)
Type data
MD5 d11f5a6f66b39346e6da9a53bb76ab91
SHA1 05f8f8b914066107e7f550bf811c06f75a9ace9e
SHA256 804d012771972312d08f0592d68e94fea86fbda440605aa1d49275353ed7edcc
CRC32 68634EE4
ssdeep 96:krX4MKOEOq0fsHoLn76NETYFnWNe4bftwznYOb1kr5mTV6czoPqRG49Yx4+bN4NG:a7qRonaA6zY41umTN089M/NVSlcv4kRx
Yara None matched
VirusTotal Search for analysis
Name 727b96dca0363f7c_acledit.dll
Submit file
Filepath C:\Program Files (x86)\foler\olader\acledit.dll
Size 8.5KB
Processes 1608 (lv.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 8d96cb171b4138f43a754317be9e982c
SHA1 3c2975e7904486f39be0455a63afaa063064a93e
SHA256 727b96dca0363f7cd5767f94bf72e0655ef1d00f44b27d496deb733eb32be12b
CRC32 1D0A1442
ssdeep 192:peH8gcV+GQqYTBBBAkvyMQ0F3OWYTWPGP:YH8gcV+GQqyAMD0WYTWPq
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name e3b0c44298fc1c14_nsc798E.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\nsc798E.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 949fd56c5a63d3f1_acppage.dll
Submit file
Filepath C:\Program Files (x86)\foler\olader\acppage.dll
Size 45.5KB
Processes 1608 (lv.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 290075961dd4856211078377d14942c8
SHA1 ad7f6dfd89a253daa70d5bbb46e819dae7eb3f61
SHA256 949fd56c5a63d3f1c20769bc2285ac5517c4ca84250c807f18247a2d93efc1a4
CRC32 9B4259D7
ssdeep 768:ppb1tuabwj1WVIlaFKuIJJPclXkxAc5J9UaXotuM5Uqw2mom:Uj1WelaFczPclwYtuM6qw2
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen
  • IsDLL - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis