popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 2c35f9bf1ee178b8_dlykor.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\dlykor.exe
Size 2.8MB
Processes 2776 (Done.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f255e3bcb01497d32f7fb95ce1c78d5e
SHA1 a2c4b48a0ee2f87616ede983fb1d9a1955cd8f28
SHA256 2c35f9bf1ee178b81a2b82c26b9bf22359fc955e87ef90a8a11d5dcb08691eba
CRC32 FDF9783B
ssdeep 49152:5wWRVmXyFiEBeuze4ZVKqarUxMpgy3fHrmOsLErHbZM+QDWYYOu4:55Yoi3uaJXYxOHLmOY4q
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • Is_DotNET_EXE - (no description)
  • UPX_Zero - UPX packed file
  • themida_packer - themida packer
VirusTotal Search for analysis
Name cf11d6b3c18d4c02_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2076 (powershell.exe)
Type data
MD5 f2f5505600e2895c007b3ff3cfe3d4aa
SHA1 f0235a3c8056872d55eeef803d1bc33bac37a753
SHA256 cf11d6b3c18d4c02466b670bcb0394ac49382e6a87ad58d2561f2660922b586c
CRC32 9AF5ED3C
ssdeep 96:EtuCojGCPDXBqvsqvJCwoJtuCojGCPDXBqvsEHyqvJCworc7HwxGlUVul:Etu6XoJtu6bHnorXxY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name e3b0c44298fc1c14_nsgE2DE.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\nsgE2DE.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 49b7477db8dd22f8_3DGDOFWHMN.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nslE39A.tmp\3DGDOFWHMN.dll
Size 6.5KB
Processes 2776 (Done.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 293165db1e46070410b4209519e67494
SHA1 777b96a4f74b6c34d43a4e7c7e656757d1c97f01
SHA256 49b7477db8dd22f8cf2d41ee2d79ce57797f02e8c7b9e799951a6c710384349a
CRC32 A8874D27
ssdeep 96:4BNbUVOFvfcxEAxxxJzxLp+eELeoMEskzYzeHd0+uoyVeNSsX4:EUVOFvf9ABJFHE+FkEad0PLVeN
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • Malicious_Library_Zero - Malicious_Library
VirusTotal Search for analysis
Name 4a85ff992b520d49_var.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\var.exe
Size 2.7MB
Processes 2776 (Done.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 df2bd9c227c008d95e556b27292e876f
SHA1 e16ee3cd4377b5d0cd6eab353e91b46996c9f8f2
SHA256 4a85ff992b520d49f5eb43cfbbc9038132d8d4195e81a2831b33ce7bcd7fde83
CRC32 52A36DA3
ssdeep 49152:Y4JsFVYoWw65ysa4jWNO1NYBk1BhQVv0N2AFiJQ3Gd1EL1DHwmwOoWGK4zsP+QDX:YlejAVjNkYEBx/FiS3qERDJw2GKc+x
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • Is_DotNET_EXE - (no description)
  • UPX_Zero - UPX packed file
  • themida_packer - themida packer
VirusTotal Search for analysis