popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 29ae7b30ed8394c5_AdvancedRun.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\AdvancedRun.exe
Size 88.9KB
Processes 2796 (JOKS.scr)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 17fc12902f4769af3a9271eb4e2dacce
SHA1 9a4a1581cc3971579574f837e110f3bd6d529dab
SHA256 29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
CRC32 CC276C7F
ssdeep 1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
Yara
  • ASPack_Zero - ASPack packed file
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 797f288d540979e6_JOKS.scr
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\JOKS.scr
Size 724.6KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 a19a91e08fe068a3fa39668805da6cdb
SHA1 ad4d0e0b83564efb2564c84e08400609a0f32e0b
SHA256 797f288d540979e65f408255969d05e60f28481ffe64104a7be6b6aa36282e56
CRC32 03939837
ssdeep 6144:d/r2aX/GW6ZfxQPcNyrWPrqfiU5Fdt1kJw990G8dPpvEcipWfNPdPkT:d/dX/GW0drWimFinaa8T
Yara
  • hide_executable_file - Hide executable file
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • UPX_Zero - UPX packed file
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
VirusTotal Search for analysis
Name cf11d6b3c18d4c02_d93f411851d7c929.customDestinations-ms~RF1cb673d.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1cb673d.TMP
Size 7.8KB
Processes 2512 (powershell.exe) 2952 (powershell.exe)
Type data
MD5 f2f5505600e2895c007b3ff3cfe3d4aa
SHA1 f0235a3c8056872d55eeef803d1bc33bac37a753
SHA256 cf11d6b3c18d4c02466b670bcb0394ac49382e6a87ad58d2561f2660922b586c
CRC32 9AF5ED3C
ssdeep 96:EtuCojGCPDXBqvsqvJCwoJtuCojGCPDXBqvsEHyqvJCworc7HwxGlUVul:Etu6XoJtu6bHnorXxY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 409186d21c7ed0ea_aGFtbem.tmp
Submit file
Filepath C:\Users\test22\AppData\Roaming\aGFtbem.tmp
Size 173.9KB
Type ASCII text, with very long lines, with no line terminators
MD5 28a533942aab6fb3d66f76caa867618e
SHA1 f98da69b7345fcbaaaa1fc0c62fa7cf7493a0cf6
SHA256 409186d21c7ed0ea21b6f598ba3f9f3ba2a8f078c94ce03b14cf5ab77a769ef1
CRC32 DE8D906C
ssdeep 3072:kG4h+sTIVZfS/7BmpH+753klu9kOblyiq6heT67fAA7pdcM:HOliZfrp+SYemrA0
Yara
  • NPKI_Zero - File included NPKI
VirusTotal Search for analysis
Name 2781270ee7d175be_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2952 (powershell.exe)
Type data
MD5 d39d2919144644cf3edc50329c2c76e5
SHA1 78197f33454620d5b61dc8b5f16ce15d4a71983a
SHA256 2781270ee7d175be6c078afad2bf5322a51ff639d3995da410a94b1ef53937b4
CRC32 911504C5
ssdeep 96:stuCojGCPDXBqvsqvJCwoxtuCojGCPDXBqvsEHyqvJCworc7HwxGlUVul:stu6Xoxtu6bHnorXxY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 6ec867dc1caa77ec_wdDzxI..tmp
Submit file
Filepath C:\Users\test22\AppData\Roaming\wdDzxI..tmp
Size 18.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 f3a100cba30b2a07a7af8886e439024e
SHA1 a454cca0db028b4d0fb29fa932c9056519efe2cf
SHA256 6ec867dc1caa77ecfd8e457d464b6bebc3be8694b4c88734fa83d197c0b214cc
CRC32 72CF6AF8
ssdeep 24:LLI10KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6Uwc6KaW:oz+JH3yJUheCVE9V8MX0PFlNU1faW
Yara None matched
VirusTotal Search for analysis