popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name ef2a03f03f9748ef_ehb3tx09sp7pc0g9ewmgexxa.exe
Submit file
Filepath C:\Users\test22\Pictures\Adobe Films\Ehb3TX09sP7PC0g9ewmGExxA.exe
Size 389.0KB
Processes 2316 (ww_testLL_0211_single.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 19b0bf2bb132231de9dd08f8761c5998
SHA1 a08a73f6fa211061d6defc14bc8fec6ada2166c4
SHA256 ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e
CRC32 081E583F
ssdeep 12288:F+bMtwrleoUUcdl5gs7wSYbHkZPu/KjGHH711P5b:FDtUlCdl5v7GkQ71JJ
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 265c2ddc8a21e6fa_egqradmp6vvhibhfuato690f.exe
Submit file
Filepath C:\Users\test22\Pictures\Adobe Films\egqRAdMP6vVHIbhfUato690f.exe
Size 318.5KB
Processes 2316 (ww_testLL_0211_single.exe)
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 3f22bd82ee1b38f439e6354c60126d6d
SHA1 63b57d818f86ea64ebc8566faeb0c977839defde
SHA256 265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
CRC32 BE70020F
ssdeep 6144:ej4R3H20xSWLE2Sgct82tCOcfX+A5yF17s:ejcG72Et8Vf81
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name e9a3c66d5e14cf9e_82yg_xksvdww7zcrd21mlhc8.exe
Submit file
Filepath C:\Users\test22\Pictures\Adobe Films\82YG_xkSvDww7zcrD21MLhC8.exe
Size 748.7KB
Processes 2796 (Zz_8WJnWJcYwE8DTXxWfai7o.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 3b25bb47c77da6404c1b75133ccf2b1f
SHA1 ad56d15bfd135c9d2e4383032dbae1cc6c9974f7
SHA256 e9a3c66d5e14cf9e6a50183cbd85e3b2ea157094f7f65c7666a0ff20cf1c73e3
CRC32 A113FFD8
ssdeep 6144:d/QiQXC3tQQ5m+ksmpk3U9j0Im4soxvjFEOTb9WmZX/8shzdsY4CpHPhnTxnV1:VQi3mQc6m6UR0Ilp1hf39Wkv8xwJBn
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name d3137fb16cc88e0c_T9aZunTSaNJLBVfIkgF5mtQo.dll
Submit file
Filepath C:\Users\test22\Documents\T9aZunTSaNJLBVfIkgF5mtQo.dll
Size 1.3MB
Processes 2316 (ww_testLL_0211_single.exe)
Type data
MD5 6542ff843d091ef9901e839405497fa2
SHA1 efc52027b56a7e8e15362bc58ebc714761547efc
SHA256 d3137fb16cc88e0c2164c883aa6f317a3b3e79130ad8ceeadf4ea10f7908d216
CRC32 9DFEE32B
ssdeep 12288:rdEQx8PubTY2ViF+vAZcXhVhPZF2fhPZPgu4WKbIgFfghPghPZPgu+KeisGBosb4:rRmATHZeiar+ernMUeviP
Yara None matched
VirusTotal Search for analysis
Name f1f90b6ffab44282_82yg_xksvdww7zcrd21mlhc8.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-TS3P8.tmp\82YG_xkSvDww7zcrD21MLhC8.tmp
Size 1.0MB
Processes 2840 (82YG_xkSvDww7zcrD21MLhC8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 89b035e6a5fd0db09a26338bb5af5ff1
SHA1 9a784d145a596c69578625fd1793d65592d740de
SHA256 f1f90b6ffab442821650618d48117fe861d19a783a862d86941e6477a5b26173
CRC32 5060C8FF
ssdeep 24576:nQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNafoXyx9DQ:Z02rPD37zzH2A6SBIfNafoKi
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name a2ce3a0fa7d2a833_e0f5c59f9fa661f6f4c50b87fef3a15a
Submit file
Filepath C:\Users\test22\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
Size 893.0B
Processes 2316 (ww_testLL_0211_single.exe) 2796 (Zz_8WJnWJcYwE8DTXxWfai7o.exe) 2516 (4dB197_1l7OerQHV9HHywWV_.exe)
Type data
MD5 d4ae187b4574036c2d76b6df8a8c1a30
SHA1 b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256 a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
CRC32 1C31685D
ssdeep 24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
Yara None matched
VirusTotal Search for analysis
Name e852926791745a6d_4db197_1l7oerqhv9hhywwv_.exe
Submit file
Filepath C:\Users\test22\Pictures\Adobe Films\4dB197_1l7OerQHV9HHywWV_.exe
Size 76.0KB
Processes 2796 (Zz_8WJnWJcYwE8DTXxWfai7o.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 ad0b9bd8cdaba862d346e9cd551f381f
SHA1 564cd97f47396bd5d3f8977fbef02691a885a666
SHA256 e852926791745a6ded438269c590cf206746c924f38a1689af277a81a6412f96
CRC32 A27E08B3
ssdeep 768:x+AugrSlcnSGbUR2aBUb4yOKMnGeEDETh6i8Xwkvqh/m8HszbSaOgNB3tXDjU:x+zO5ni2aB3yOK4MM6NgkU/m8HkRtXHU
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 647920158828a09f_xetoxmkcqtohpfffufdc0rz7.exe
Submit file
Filepath C:\Users\test22\Pictures\Adobe Films\xETOXMkcQToHPFfFUFdC0rZ7.exe
Size 138.5KB
Processes 2796 (Zz_8WJnWJcYwE8DTXxWfai7o.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d593ec9f130fc6e0db54f0054d7dbefc
SHA1 9772aabc71ee51b51ccf7fd785d812d40a1aa680
SHA256 647920158828a09f177db4e46aaeebd348f53f670e81752d8fe7448a1ef15b57
CRC32 D2421DDC
ssdeep 1536:VIGwVG30AQNfAUy29sCkCkvrcgq24nTrCPxXMGJAnDqh+nO/jyCf2YviYqFU4ofV:iX1AGfC2hTmQPG9h+yuCfbiYonE7X
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 28859fa0e72a262e_pidhtsigei8dramayu9k8ghn89.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\pidHTSIGEi8DrAmaYu9K8ghN89.dll
Size 167.5KB
Processes 2488 (egqRAdMP6vVHIbhfUato690f.exe) 3044 (301tY1t7qg8_zDCV75DGJBHH.exe)
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 f07ac9ecb112c1dd62ac600b76426bd3
SHA1 8ee61d9296b28f20ad8e2dca8332ee60735f3398
SHA256 28859fa0e72a262e2479b3023e17ee46e914001d7f97c0673280a1473b07a8c0
CRC32 B757082A
ssdeep 3072:tw96uifZtOVSgpyt2RGe2SOrC4WOcfV+UmLosIwW:GE2Sgct82tCOcfX
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name a0914ae7b12a7873_zz_8wjnwjcywe8dtxxwfai7o.exe
Submit file
Filepath C:\Users\test22\Documents\Zz_8WJnWJcYwE8DTXxWfai7o.exe
Size 403.0KB
Processes 2548 (Ehb3TX09sP7PC0g9ewmGExxA.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 7c53b803484c308fa9e64a81afba9608
SHA1 f5c658a76eee69bb97b0c10425588c4c0671fcbc
SHA256 a0914ae7b12a78738b47a8c48b844db99ceb902b835274500eb07101cce540f0
CRC32 926C475F
ssdeep 6144:fkP3bQ/UCg7m1ugaSIv1pE0EAPMrGWsWDWidF0HQszCZ2Ftppb9Y81+k7pq7FLfM:f23k/b1ugajS2zt
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
VirusTotal Search for analysis
Name 4ece868bbdca1c6f_e0f5c59f9fa661f6f4c50b87fef3a15a
Submit file
Filepath C:\Users\test22\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
Size 252.0B
Processes 2316 (ww_testLL_0211_single.exe) 2796 (Zz_8WJnWJcYwE8DTXxWfai7o.exe) 2516 (4dB197_1l7OerQHV9HHywWV_.exe)
Type data
MD5 e574767827d3a3b7d666ff602687e49d
SHA1 89a32a6601c362b05cf55a252a735c87f4c02028
SHA256 4ece868bbdca1c6f1b64feca7735a6293db0bcd2a0873d70edf314ddfc3f1fec
CRC32 92C2E38E
ssdeep 3:kkFklzuNvfllXlE/0PhxldllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB1yDHLlh:kK0ulhj5liBAIdQZV7QMTan1
Yara None matched
VirusTotal Search for analysis
Name 97c0c04ae83b9599_d78lyqpvrynmeru4vfpgms_c.exe
Submit file
Filepath C:\Users\test22\Pictures\Adobe Films\d78LyqpVrYNmErU4VFpgMs_C.exe
Size 1.3MB
Processes 2796 (Zz_8WJnWJcYwE8DTXxWfai7o.exe)
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 6d6147dc459a34905e68396a8c554525
SHA1 f9c5ae56737c3b4e0d0157f8755f06b091606984
SHA256 97c0c04ae83b9599b78f61d809cfb2428984b25a79d2d986dfdbad6858101af9
CRC32 ECEFC66C
ssdeep 24576:P/mj8gr6siw8y8KbE0N4TMAeulQI1N6y83bMJb2dtGulJe:POjH7iby84E0aTrlQcNkbYidv
Yara
  • ASPack_Zero - ASPack packed file
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 9884e9d1b4f8a873__shfoldr.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-OTC82.tmp\_isetup\_shfoldr.dll
Size 22.8KB
Processes 536 (82YG_xkSvDww7zcrD21MLhC8.tmp)
Type PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
CRC32 AE2C3EC2
ssdeep 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • IsDLL - (no description)
VirusTotal Search for analysis
Name 203d7b61eac96de8_idp.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-OTC82.tmp\idp.dll
Size 216.0KB
Processes 536 (82YG_xkSvDww7zcrD21MLhC8.tmp)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 8f995688085bced38ba7795f60a5e1d3
SHA1 5b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256 203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
CRC32 90D9CA64
ssdeep 3072:6XHWOJd5D0ocxYF0+CT4zNHNpwZNjlhBKL/kg/0r4YLuztNJaFlCx:6G6tae7wZNOpiWP
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 02beadecf04d3e04_nrsy5lhyzqw1s2ctgmnncwa9.exe
Submit file
Filepath C:\Users\test22\Pictures\Adobe Films\Nrsy5LhyZqW1S2cTgMnNCWa9.exe
Size 517.0B
Processes 2796 (Zz_8WJnWJcYwE8DTXxWfai7o.exe)
Type HTML document, ASCII text, with CRLF line terminators
MD5 9d5e0e5cc1a63273e3c4ecd3b383c05e
SHA1 46a9a06dae58ab24873a4396ef85f0e7d6614f15
SHA256 02beadecf04d3e0416ad83736708a81414bd7c3f1cb7634cbc04bea1112ea673
CRC32 69B323EA
ssdeep 12:hnMEwuiuX4w4vy4Whk7pCHWRPT4qdIPGv:hMNmMvy4WopCHWRP8qdF
Yara None matched
VirusTotal Search for analysis
Name 39d7e0eefe3f1f05_dybala.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-OTC82.tmp\DYbALA.exe
Size 632.0KB
Processes 536 (82YG_xkSvDww7zcrD21MLhC8.tmp)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 8491639b7ee679dc16690f6fdd2c058a
SHA1 50a6b570d228be780577b5f052d85c7ef14191d1
SHA256 39d7e0eefe3f1f055050950f113617fe6ddd972e65064afd90c85b15b4e7ccd6
CRC32 5F5CA13E
ssdeep 12288:lEjnlwV8WuppJgXHE/50RtilhTeVOwhu7:lEjneV87
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name b1c59897a298e2df_01nwj3eqrrxxqcofclompgme.exe
Submit file
Filepath C:\Users\test22\Pictures\Adobe Films\01NWJ3EqrrXXQcofclOmpgme.exe
Size 721.0KB
Processes 2316 (ww_testLL_0211_single.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b73f590d09265f688b10a58699e4ad95
SHA1 8a04fe83786a887f2d5eb68fcd4c36f36e047f66
SHA256 b1c59897a298e2df350282eabd39c1adb01408d90c800318838aa8a6d4939a43
CRC32 8A476FB0
ssdeep 12288:twjjwQgU/FSemKKJuj+6NTEhoaUXixut3RxDarDb15c3JCQIab/Zo8J:WjjHN/8emKKJn6NTEmiiRZar//cvbxJ
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name e5e540171fdb508b_xmrgmwwvt1js2s4achs4n12h.exe
Submit file
Filepath C:\Users\test22\Pictures\Adobe Films\xMRgMWwvt1Js2S4aChs4n12H.exe
Size 381.0KB
Processes 2796 (Zz_8WJnWJcYwE8DTXxWfai7o.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 49252ec4ef4b0dbf252e84686ca1f134
SHA1 26428e6dac64addc42848042f6bb600d98d821e9
SHA256 e5e540171fdb508b9c6a3ab4fa62fa5b8c2645fadd036b7c8d9932e990575092
CRC32 41661A9B
ssdeep 6144:V7Kk/GwTbx08au8+9GajJadN9VeLea7rozNK/9kW4BFGkDksVZu4:9J/HbIVHaLLenzNK/9ktFGkwY
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 388a796580234efc__setup64.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-OTC82.tmp\_isetup\_setup64.tmp
Size 6.0KB
Processes 536 (82YG_xkSvDww7zcrD21MLhC8.tmp)
Type PE32+ executable (console) x86-64, for MS Windows
MD5 e4211d6d009757c078a9fac7ff4f03d4
SHA1 019cd56ba687d39d12d4b13991c9a42ea6ba03da
SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
CRC32 2CDCC338
ssdeep 96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
Yara
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis