popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name efaf87da4c55ab7b_wwi.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\wwi.exe
Size 2.8MB
Processes 620 (CurrenyCalculatorInstaller.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 8a33634964add1181f84249377c1b316
SHA1 696a03c0071daca980506ba21385abb45dae6f05
SHA256 efaf87da4c55ab7b0783a5f95103dedde720716c36b5173724252ed45c255fbe
CRC32 56B40EA5
ssdeep 49152:Uj5/WujigEl2yFrhNdeUPobFPxg7fe6vVgVbuKoS1uovA9JVXtJ1+Hu7WX:q5+uulJrhNdeUsxg7W6eEJbPNsHu7WX
Yara
  • PE_Header_Zero - PE File Signature
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • Is_DotNET_EXE - (no description)
  • themida_packer - themida packer
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 94b5243af5c2f084_tmp8B88.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B88.tmp
Size 280.4KB
Type data
MD5 3b9bea4730b3f147f554a5753d59470c
SHA1 96be0d0c396ff3959855922f7a90922257a24ef7
SHA256 94b5243af5c2f084d51aa036290292f1d487ce22bf6bafe6fb06ce221c2a8246
CRC32 08E48262
ssdeep 6144:+faRPrhchAGtVFR86lQsMU61k/pslzCLJg2FT6xmVKLvqFIlak+:pSjrQsMDW/p2z0JJT6xRuFf
Yara None matched
VirusTotal Search for analysis
Name d6269f22946a00d9_tmp8B89.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B89.tmp
Size 92.0KB
Type data
MD5 ccf2f77dcf69db0c6293fc48c62fe1ac
SHA1 637aaee2443bbf069b903e25b8c77bffc969e8c9
SHA256 d6269f22946a00d90306fbc1c1f0e5ba31c23d50467e9b89535fbfadb66f8d49
CRC32 2867179A
ssdeep 1536:svYMVblRLfRMWB5et60aJGAdoHcnNmKPSgriAn1HfhrRKm8osPxq/EcKc5f:tM9lRLWWGVyPdoANmKPSGJBfpRYqMfcZ
Yara None matched
VirusTotal Search for analysis
Name 38c389720b75365f_tmp90FD.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp90FD.tmp
Size 72.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 c480140ee3c5758b968b69749145128d
SHA1 035a0656bc0d1d376dfc92f75fa664bdf71b3e4d
SHA256 38c389720b75365fcb080b40f7fdc5dc4587f4c264ec4e12a22030d15709e4a9
CRC32 954A724F
ssdeep 96:f0CWo3dOEctAYyY9MsH738Hsa/NTIdE8uKIaPdUDFBlrrVY/qBOnx4yWTJereWbY:fXtd69TYndTJMb3j0
Yara None matched
VirusTotal Search for analysis
Name f7a73ab6af16f6f7_tmp8B55.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B55.tmp
Size 885.7KB
Type data
MD5 cab9ead02dd73038c3b38e6e1e809629
SHA1 89d84eb971b789dc922880ce0b5b805cfeddeac8
SHA256 f7a73ab6af16f6f760f6a5b1a82669c41736f85c537bb2134370738272d51b3a
CRC32 9BFEB3BD
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 49b7477db8dd22f8_V5Q68SOG.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nso6357.tmp\V5Q68SOG.dll
Size 6.5KB
Processes 620 (CurrenyCalculatorInstaller.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 293165db1e46070410b4209519e67494
SHA1 777b96a4f74b6c34d43a4e7c7e656757d1c97f01
SHA256 49b7477db8dd22f8cf2d41ee2d79ce57797f02e8c7b9e799951a6c710384349a
CRC32 A8874D27
ssdeep 96:4BNbUVOFvfcxEAxxxJzxLp+eELeoMEskzYzeHd0+uoyVeNSsX4:EUVOFvf9ABJFHE+FkEad0PLVeN
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 380adedf1de10407_tmp8B9A.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B9A.tmp
Size 961.1KB
Type data
MD5 e1b3888f9d85647674b6ac4e2cc745ef
SHA1 5730e17fd0432bb4add4761b96e6af247c4a11e7
SHA256 380adedf1de10407a541e9777469a712b4eb57dc0d828e606734c5c692ac03a6
CRC32 EF914625
ssdeep 24576:RpmoFELtc9RSOwELn4DHO+sEv7Q/heiCM1B2M1oE6yehNwbW1d:6oFctc3wEL4DH9ss0XbB0EqD
Yara None matched
VirusTotal Search for analysis
Name 9e6e4772050998a5_tmp8B31.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B31.tmp
Size 10.0B
Type ASCII text, with no line terminators
MD5 eb6b6c90251ab33cee784713c451e6d8
SHA1 451685e9efac4a6dc1fee73ec53ffb6b2c4c38b5
SHA256 9e6e4772050998a5c0dc3c61acf3dab0a7e594566171fa5746d6b62f9598efb6
CRC32 22598B08
ssdeep 3:IS:7
Yara None matched
VirusTotal Search for analysis
Name 88e65aa69858b179_tmp8B33.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B33.tmp
Size 31.3KB
Type data
MD5 78af5f2f35746bdaa5499e29daca737d
SHA1 7ac488b31b66b81fcd7711453acc6efede1aaf32
SHA256 88e65aa69858b179558b77e4542670d29399e83fb04dd4f207cbe9ca8ddf3d13
CRC32 71A2CC37
ssdeep 768:2zA1C82+UYugHPAH/Ug2+I7TcJTvfFAzl6vj+vFepKb:2MCaUYhIUgus9vdAzl6vjOb
Yara None matched
VirusTotal Search for analysis
Name 1613dfca627df925_tmp8B44.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B44.tmp
Size 152.3KB
Type data
MD5 678f200bbdcbd766738c556fc32a58d8
SHA1 d04d2b7feb4ae5217b2e506b7029d2932a1b897d
SHA256 1613dfca627df92567ddad65992d171f58ce44f6606f6ce6a72b0d0d17641912
CRC32 D85EC086
ssdeep 3072:TUzncZdDUeK0wBA1fwBwwLjbI3czjlpIpLdxgQ5SGP8RSn5DD+ZhTCn69ABgd:gwT8IRQlipLzSFcnFDiFSA
Yara None matched
VirusTotal Search for analysis
Name cf11d6b3c18d4c02_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2772 (powershell.exe)
Type data
MD5 f2f5505600e2895c007b3ff3cfe3d4aa
SHA1 f0235a3c8056872d55eeef803d1bc33bac37a753
SHA256 cf11d6b3c18d4c02466b670bcb0394ac49382e6a87ad58d2561f2660922b586c
CRC32 9AF5ED3C
ssdeep 96:EtuCojGCPDXBqvsqvJCwoJtuCojGCPDXBqvsEHyqvJCworc7HwxGlUVul:Etu6XoJtu6bHnorXxY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name f16ed6f7ff049e79_tmp8B9B.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B9B.tmp
Size 898.8KB
Type data
MD5 1c3a0afd5428ea2b1e11aeea596d2dbc
SHA1 e41928731b20b7420e6f1cceaaec451e400cac43
SHA256 f16ed6f7ff049e79be0a98206dfad09ccf349ae89161d16b17de023e43db177f
CRC32 CA3EE9A8
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 24922db2148ca3d3_tmp8B67.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B67.tmp
Size 273.3KB
Type data
MD5 19b0656634435462e896fef744aa57e7
SHA1 95ffda562ba8403f95a4a9c62835998f25098aee
SHA256 24922db2148ca3d3dd35d6b7d6faeeba2d560637007c80833cb31e7b3aedd2e8
CRC32 4B19E78A
ssdeep 6144:MhnRaQKsSbHY9fFFd4nIjAnBbP9mUcsOrxQLPGhVX1:MYQKsSbH49AIMndP9mUcsOrUAF
Yara None matched
VirusTotal Search for analysis
Name 4acabf712361cecc_tmp8BAD.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8BAD.tmp
Size 687.0KB
Type data
MD5 b02d99e427bcbb0cde5927694a35dc61
SHA1 dbd860832b102d5c0ecadfd652d04595236225d9
SHA256 4acabf712361ceccfa30cfe858d8641751f3357b552438fcb4ed7b7e5466738a
CRC32 D679D58F
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 1613dfca627df925_tmp8B43.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B43.tmp
Size 152.3KB
Type data
MD5 678f200bbdcbd766738c556fc32a58d8
SHA1 d04d2b7feb4ae5217b2e506b7029d2932a1b897d
SHA256 1613dfca627df92567ddad65992d171f58ce44f6606f6ce6a72b0d0d17641912
CRC32 D85EC086
ssdeep 3072:TUzncZdDUeK0wBA1fwBwwLjbI3czjlpIpLdxgQ5SGP8RSn5DD+ZhTCn69ABgd:gwT8IRQlipLzSFcnFDiFSA
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_nsj629B.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\nsj629B.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name cde468f4deeca2b2_tmp8B78.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B78.tmp
Size 625.2KB
Type data
MD5 68e1490fdc2af0fc3c5e8ad37db6d53a
SHA1 93a4a61f5703069393623bc4e89d1fe36023af3c
SHA256 cde468f4deeca2b2040a03d9b62840c1b524e311ad240b906980f2810693d2cd
CRC32 C0D062E5
ssdeep 12288:1WSE1iMAghMcFabgqQ5MMFOoIO7K+BifDmJyOusrE1qyyJj9DKnTNUzhTYpM:1RE1tfhMekgvMYOo97K+5sOusrECdKJQ
Yara None matched
VirusTotal Search for analysis
Name 9ab924f706990f3b_tmp8BBD.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8BBD.tmp
Size 88.6KB
Type data
MD5 0009fbc4ec5125123aaeafe56f894be7
SHA1 ba82cf90e66394c248494643d5677de68775ed3f
SHA256 9ab924f706990f3b2db79d7507cdd3fe62751bfc3393366c24cd5111331adeee
CRC32 82B5D5BB
ssdeep 1536:tUb1CX80wlDfRZKku00PAbXeA5ndwCbzOrBrmsCXCiegpgqZBN1G5CWn3LUEuJBJ:Gb1CL6DZEtobtdbCrBCXCivptZBmCW7C
Yara None matched
VirusTotal Search for analysis
Name f7a73ab6af16f6f7_tmp8B56.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B56.tmp
Size 885.7KB
Type data
MD5 cab9ead02dd73038c3b38e6e1e809629
SHA1 89d84eb971b789dc922880ce0b5b805cfeddeac8
SHA256 f7a73ab6af16f6f760f6a5b1a82669c41736f85c537bb2134370738272d51b3a
CRC32 9BFEB3BD
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name cde468f4deeca2b2_tmp8B77.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B77.tmp
Size 625.2KB
Type data
MD5 68e1490fdc2af0fc3c5e8ad37db6d53a
SHA1 93a4a61f5703069393623bc4e89d1fe36023af3c
SHA256 cde468f4deeca2b2040a03d9b62840c1b524e311ad240b906980f2810693d2cd
CRC32 C0D062E5
ssdeep 12288:1WSE1iMAghMcFabgqQ5MMFOoIO7K+BifDmJyOusrE1qyyJj9DKnTNUzhTYpM:1RE1tfhMekgvMYOo97K+5sOusrECdKJQ
Yara None matched
VirusTotal Search for analysis
Name 20d95e2088d0956a_tmp8BBE.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8BBE.tmp
Size 341.2KB
Type data
MD5 c4fe0231a62ac1a333491872bae8a596
SHA1 6d6c9e16945247efc5d7440fa2d3fd6d50d586b2
SHA256 20d95e2088d0956af485f33b94fd4ba158bb966b20b418a46f21abea25d384ef
CRC32 8B32DD6E
ssdeep 6144:+ZQVO2O3G8ta1by2rpvlUb8E1ESV0YAROya86FSJxPgxHGS2vv6kHQsK7:wQcT3Lib95l08KEqLTFSAxHGvCmE
Yara None matched
VirusTotal Search for analysis
Name 12c78c9260e3a063_tmp8B57.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B57.tmp
Size 975.8KB
Type data
MD5 cbd0b8b7f8282d062ec9d05ca4c1e662
SHA1 065d880f19ac4cd67504037614eaee8f4059cb15
SHA256 12c78c9260e3a063b73d0e1b782f249ea8fa75e8c7541c589d67449ef8828428
CRC32 16A9FB54
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name f528ec6ebffb101f_tmp8B8A.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B8A.tmp
Size 230.1KB
Type data
MD5 2eba488d541f8f3fda77fabd130bef16
SHA1 5875ae06399d39f787a38738aaebecf8d873ef74
SHA256 f528ec6ebffb101f76457eef88e295b7ca290d134e5386907cda333d77c1c617
CRC32 03EF1FA4
ssdeep 6144:3axipu7kSy7EuiI4j3nhsY3QiIfWnEOY/p:qxipu7zux4rhsY3QiIfWpYR
Yara None matched
VirusTotal Search for analysis
Name 88e65aa69858b179_tmp8B32.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B32.tmp
Size 31.3KB
Type data
MD5 78af5f2f35746bdaa5499e29daca737d
SHA1 7ac488b31b66b81fcd7711453acc6efede1aaf32
SHA256 88e65aa69858b179558b77e4542670d29399e83fb04dd4f207cbe9ca8ddf3d13
CRC32 71A2CC37
ssdeep 768:2zA1C82+UYugHPAH/Ug2+I7TcJTvfFAzl6vj+vFepKb:2MCaUYhIUgus9vdAzl6vjOb
Yara None matched
VirusTotal Search for analysis
Name 870fca1ec4bfd83a_wwl.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\wwl.exe
Size 2.5MB
Processes 620 (CurrenyCalculatorInstaller.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 ae5e9419a7be38c8e8a540f154f44e07
SHA1 1162b66246d2c6b6ec2ddd3f87732dd73647d78e
SHA256 870fca1ec4bfd83a616fd016818228413103c4e51aaa0827371e6f20de594243
CRC32 14B31386
ssdeep 49152:bIhi/Wil9s7U+fXZVCp53/n5i2EA73mstL4lc5qJx2jNHS:bYiOiTsJVCp5PLE0ptLoeqJxgNHS
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • themida_packer - themida packer
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 12c78c9260e3a063_tmp8B56.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B56.tmp
Size 975.8KB
Type data
MD5 cbd0b8b7f8282d062ec9d05ca4c1e662
SHA1 065d880f19ac4cd67504037614eaee8f4059cb15
SHA256 12c78c9260e3a063b73d0e1b782f249ea8fa75e8c7541c589d67449ef8828428
CRC32 16A9FB54
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 9e6e4772050998a5_tmp8B32.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B32.tmp
Size 10.0B
Type ASCII text, with no line terminators
MD5 eb6b6c90251ab33cee784713c451e6d8
SHA1 451685e9efac4a6dc1fee73ec53ffb6b2c4c38b5
SHA256 9e6e4772050998a5c0dc3c61acf3dab0a7e594566171fa5746d6b62f9598efb6
CRC32 22598B08
ssdeep 3:IS:7
Yara None matched
VirusTotal Search for analysis
Name 6ec867dc1caa77ec_tmp9064.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp9064.tmp
Size 18.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 f3a100cba30b2a07a7af8886e439024e
SHA1 a454cca0db028b4d0fb29fa932c9056519efe2cf
SHA256 6ec867dc1caa77ecfd8e457d464b6bebc3be8694b4c88734fa83d197c0b214cc
CRC32 72CF6AF8
ssdeep 24:LLI10KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6Uwc6KaW:oz+JH3yJUheCVE9V8MX0PFlNU1faW
Yara None matched
VirusTotal Search for analysis
Name 24922db2148ca3d3_tmp8B66.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp8B66.tmp
Size 273.3KB
Type data
MD5 19b0656634435462e896fef744aa57e7
SHA1 95ffda562ba8403f95a4a9c62835998f25098aee
SHA256 24922db2148ca3d3dd35d6b7d6faeeba2d560637007c80833cb31e7b3aedd2e8
CRC32 4B19E78A
ssdeep 6144:MhnRaQKsSbHY9fFFd4nIjAnBbP9mUcsOrxQLPGhVX1:MYQKsSbH49AIMndP9mUcsOrUAF
Yara None matched
VirusTotal Search for analysis
Name 3b046d30dc2e6021_tmp90A8.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp90A8.tmp
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 e185515780e9dcb21c3262899c206308
SHA1 230714474693919d93949ab5a291f7ec02fd286f
SHA256 3b046d30dc2e6021be55d1bd47c2a92970856526c021df5de6e4ea3c4144659b
CRC32 25EF2A64
ssdeep 24:TLNg/5UcJOyTGVZTPaFpEvg3obNmCFk6Uwcc85fBvlllYu:TC/ecVTgPOpEveoJZFrU1cQBvlllY
Yara None matched
VirusTotal Search for analysis