popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name d6431d5645fffd05_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2248 (powershell.exe)
Type data
MD5 260d23ce04a8f8555a73b7d2dc15e911
SHA1 ebad746fb7de847c50f7502a44f6e35534733efd
SHA256 d6431d5645fffd05a23166d630253bc7ce8c099cf6e9c956f8ae5e1249ee8588
CRC32 11D6B213
ssdeep 96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ctvXo5tvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name a2ce3a0fa7d2a833_e0f5c59f9fa661f6f4c50b87fef3a15a
Submit file
Filepath C:\Users\test22\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
Size 893.0B
Processes 2156 (build.exe)
Type data
MD5 d4ae187b4574036c2d76b6df8a8c1a30
SHA1 b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256 a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
CRC32 1C31685D
ssdeep 24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
Yara None matched
VirusTotal Search for analysis
Name 18b27eb6ec1898c6_build.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\build.exe
Size 50.0KB
Processes 1540 (bild6.exe) 2876 (cmd.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 8bc904cbf806e8b28b6c21f1321fa019
SHA1 64c0e9e09d37587d0b418e3aed6162ccc4948987
SHA256 18b27eb6ec1898c6a8422e43e386f901eca8f09949eb63229d53f5041e5d2910
CRC32 31C564F6
ssdeep 1536:vS9MjY9Jm8XtXGPSWb0RSeUlcq4CJSLuza:vS9MjYjmyLWb0RSeDq4CJnG
Yara
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RFefceaf.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFefceaf.TMP
Size 7.8KB
Type data
MD5 b0c9ff441742f3847ea27da9dee7f2cd
SHA1 c42a1eb32ba953a0ce5d8635caabf71b5b281495
SHA256 a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4
CRC32 0BBCAB1A
ssdeep 96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 49b7477db8dd22f8_TIXYWCH.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nswBFE1.tmp\TIXYWCH.dll
Size 6.5KB
Processes 1540 (bild6.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 293165db1e46070410b4209519e67494
SHA1 777b96a4f74b6c34d43a4e7c7e656757d1c97f01
SHA256 49b7477db8dd22f8cf2d41ee2d79ce57797f02e8c7b9e799951a6c710384349a
CRC32 A8874D27
ssdeep 96:4BNbUVOFvfcxEAxxxJzxLp+eELeoMEskzYzeHd0+uoyVeNSsX4:EUVOFvf9ABJFHE+FkEad0PLVeN
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name f1d6c062a7bb6ca5_e0f5c59f9fa661f6f4c50b87fef3a15a
Submit file
Filepath C:\Users\test22\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
Size 252.0B
Processes 2156 (build.exe)
Type data
MD5 dfcbc884c507e41e6af5c1476c0c3e90
SHA1 d1b623c37356ca45cae4fc1b89b121b6f6d285f1
SHA256 f1d6c062a7bb6ca5c083fa493d21fc1a03afe84e929d9bf10d19b12d1e712ca5
CRC32 0BC986BF
ssdeep 3:kkFklqk31fllXlE/Bi9llPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB15RNU2UPlN:kKogiZliBAIdQZV742MN
Yara None matched
VirusTotal Search for analysis
Name e3258a34514b7d09_port.dat
Submit file
Filepath C:\Users\test22\AppData\Local\82t5k7skbj\port.dat
Size 4.0B
Processes 2156 (build.exe)
Type ASCII text, with no line terminators
MD5 8e065119c74efe3a47aec8796964cf8b
SHA1 43e2c7a71c61bbadca1d46be8db5efc21cbadaff
SHA256 e3258a34514b7d09da9f53689ab5b866c4277b4ec62cdabab68494af60063855
CRC32 9EF29AFB
ssdeep 3:Ldn:p
Yara None matched
VirusTotal Search for analysis
Name 262f7601489a81be_stalker-wix64winx32.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\STALKER-wix64winx32.exe
Size 145.5KB
Processes 1540 (bild6.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 e5761f181e221c4a029fa169f3766a94
SHA1 73175ed04161aee5236026eee41ba23664777078
SHA256 262f7601489a81beb8d3551d2425b7c2f080563a10877174024b40a6e44b2925
CRC32 AF7D635F
ssdeep 3072:YV+m5cnQmRSdVx7oW/sk8dV2chWZC8e8hC:YjeSxkkchWI
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • ConfuserEx_Zero - Confuser .NET
VirusTotal Search for analysis
Name e3b0c44298fc1c14_nsgBFD0.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\nsgBFD0.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis