popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 340c8464c2007ce3_cred64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll
Size 162.0B
Processes 2976 (rugen.exe)
Type HTML document, ASCII text, with CRLF line terminators
MD5 1b7c22a214949975556626d7217e9a39
SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
CRC32 CC58D737
ssdeep 3:qVoB3tURObOb0qHXboAcMBXqWrKb0GklIVLLPROZ/eIwcWWGu:q43tIkObRHXiMIWObtklI5LPROeIpfGu
Yara None matched
VirusTotal Search for analysis
Name 850cd190aaeebcf1_i5403218.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP000.TMP\i5403218.exe
Size 11.0KB
Processes 2824 (foto172.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
CRC32 C025CC12
ssdeep 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
Yara
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name e5d040f2672e127c_x6553546.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP000.TMP\x6553546.exe
Size 317.0KB
Processes 2824 (foto172.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 63013edde3ca3b5b50c73266a823cee4
SHA1 94e3ab68cb9515f30d4a3b8e6bb0ce9ce4148478
SHA256 e5d040f2672e127cabf949a67edf378f7427218a65e56a4e9b5cb52283d08750
CRC32 34C25FF8
ssdeep 6144:KLy+bnr+gp0yN90QEeVYc+tgUSaUqJB3oXGuja33nqL:9Mr4y90cKc+tgUSaUscGH33qL
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • CAB_file_format - CAB archive file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 87928e9e93579f67_fotod95.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000028051\fotod95.exe
Size 508.8KB
Processes 2976 (rugen.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 7aaca4058887c8bd7fedee9a9d4c0d0d
SHA1 76c7c8f998fbbf3a9967b49dc50d1d1ec0cbdcae
SHA256 87928e9e93579f6728831187967204079ef42155525163c20ee0c3c8259982ab
CRC32 57B09D2F
ssdeep 12288:aBwtm03zrTCgfOwJ9dqIoCUV3wVH66lXFd:Osm0/POkdoLVgVh
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 7a2b6fb67c47b354_y4623841.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP002.TMP\y4623841.exe
Size 258.0KB
Processes 2052 (fotod95.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8d6af971398180d1612b81d48ed07e3f
SHA1 880094f0f362f52bb7e46c8729dc188bca8f8095
SHA256 7a2b6fb67c47b35415e6e6a4deeca073d1bd9e66d7feae6cdae633a6602d62c9
CRC32 E084880C
ssdeep 6144:K3y+bnr+pp0yN90QEekR0AhSJSAM5CR7vRK:NMr1y90UkR6/M5iRK
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • CAB_file_format - CAB archive file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 00f972eb3d4d2fac_n0096414.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP000.TMP\n0096414.exe
Size 205.0KB
Processes 884 (fotod95.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 835f1373b125353f2b0615a2f105d3dd
SHA1 1aae6edfedcfe6d6828b98b114c581d9f15db807
SHA256 00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
CRC32 B342F64B
ssdeep 3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 467d3ee4a169a2c9_y2039413.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP000.TMP\y2039413.exe
Size 257.5KB
Processes 884 (fotod95.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 14bee838fa636973cdb25dc7e658353c
SHA1 b03e6c92f8f427ab1b01828d0d2de22beea72389
SHA256 467d3ee4a169a2c9d1932268713b75c5d2d4618fd10ae9302461a20f9e0805eb
CRC32 CBD02D2B
ssdeep 6144:K8y+bnr+up0yN90QE13rDVQ50dh2Kwpxw3k72x:4MrGy90TrDVQ50v2Kw0k2x
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • CAB_file_format - CAB archive file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 08dabdd0b0fb13d5_clip64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
Size 89.0KB
Processes 2976 (rugen.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 83fc14fb36516facb19e0e96286f7f48
SHA1 40082ca06de4c377585cd164fb521bacadb673da
SHA256 08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
CRC32 7E54004B
ssdeep 1536:Uo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUGNaB89p:UoUCWbBNpplToUs1uNhj25LJU6aB89p
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 92ab634a7682dcf1_foto172.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000027051\foto172.exe
Size 497.3KB
Processes 2976 (rugen.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 9941966a804044c9d0f594cdce653d17
SHA1 85481ae75f9fc9c25197c15b13ab55a465ff969f
SHA256 92ab634a7682dcf1a9a07eb4f8d2bc539dacee2eb51a76ad0ab015e0e6843a00
CRC32 5AFBC63C
ssdeep 12288:WQ03zpIW+1FW2vYS5eE6vlnbEaWqScnbtIJ8:WQ0qWSo2vAZgaNSMbto8
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis