Dropped Files | ZeroBOX

Name	06d230cca12e200a_pdf.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\pdf.exe
Size	586.0KB
Processes	2556 (None)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`6e65a0fcf114bb1e4eac17c66ba4cdc3`
SHA1	`5de6eb44dafecaecd1571ee1b8e43e272d64c6e6`
SHA256	`06d230cca12e200a7b7400e0a6a36fec7811a9d88fadb147fef454c953a23061`
CRC32	`55E9E196`
ssdeep	`12288:iBzcmhiTek6HhWTQopA4FIGD3+p0YWKATE6W3UvbZyqw7cqoxdzYixBFmRqMsb/E:iBomhiSJWRpXFIG6jWKATE6WEvbgqw/m`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
VirusTotal	Search for analysis

Name	9a1d170644b9a263_tmp799F.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp799F.tmp
Size	1.5KB
Processes	2848 (Wechatsextup.exe) 2264 (powershell.exe)
Type	XML 1.0 document, ASCII text
MD5	`cfeb7284e527134a19d6604ad8191e55`
SHA1	`887ff942ce1f50ffbf8720f8f27492f09933cc12`
SHA256	`9a1d170644b9a2633d65a1650268f70fe8672ff65a44bbaba46eb0b278aa90aa`
CRC32	`0E7697C7`
ssdeep	`24:2di4+S2qhH/1ny1mEUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtgxvn:cgefAYrFdOFzOzN33ODOiDdKrsuTwv`
Yara	None matched
VirusTotal	Search for analysis

Name	e82f69998512b24f_tmp1AF0.tmp.bat Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp1AF0.tmp.bat
Size	149.0B
Processes	2556 (None) 2184 (cmd.exe)
Type	DOS batch file, ASCII text, with CRLF line terminators
MD5	`e093d371ce1f2f103a65b97a5a07ad37`
SHA1	`53b684730556115daebe020fac8a259e0ae69fbb`
SHA256	`e82f69998512b24f25a155a75125f692ba87508a37ade6a6767d9f7c59cacb16`
CRC32	`4F21511A`
ssdeep	`3:mKDDCMNqTtvL5omWxpcL4EaKC5XLsmqRDmWxpcL4E2J5xAInTRI+EGZPy:hWKqTtT6mQpcLJaZ5bsmq1mQpcLJ23fG`
Yara	None matched
VirusTotal	Search for analysis

Name	cf11d6b3c18d4c02_d93f411851d7c929.customDestinations-ms~RF101d678.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF101d678.TMP
Size	7.8KB
Processes	2264 (powershell.exe) 2020 (powershell.exe)
Type	data
MD5	`f2f5505600e2895c007b3ff3cfe3d4aa`
SHA1	`f0235a3c8056872d55eeef803d1bc33bac37a753`
SHA256	`cf11d6b3c18d4c02466b670bcb0394ac49382e6a87ad58d2561f2660922b586c`
CRC32	`9AF5ED3C`
ssdeep	`96:EtuCojGCPDXBqvsqvJCwoJtuCojGCPDXBqvsEHyqvJCworc7HwxGlUVul:Etu6XoJtu6bHnorXxY`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis