popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name e3b0c44298fc1c14___tmp_rar_sfx_access_check_24061593
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\__tmp_rar_sfx_access_check_24061593
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name e1316db048f69d0c_4.zip
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\4.zip
Size 4.0MB
Processes 2544 (4XXR.exe)
Type Zip archive data, at least v2.0 to extract
MD5 39fe50507b6a049fba8e9820eccc5630
SHA1 3349dacbc0c9da27ccddc5c74edd0caabfdf8801
SHA256 e1316db048f69d0c169c8f111289e9b09f8ec836bb4eb4e2489b5861bbeeaddd
CRC32 85DC0346
ssdeep 98304:5rBmaDgt3HzjZ9UUg1+6c5XsvoThzsYy6+63WDxR/NaH9wvzVtvRcQlhq:51mco3HXUUg1+/moH9GS9wvxZRcQC
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name 864e5117cdfd0195_vbs.vbs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\vbs.vbs
Size 114.0B
Processes 2544 (4XXR.exe) 2852 (cmd.exe)
Type ASCII text, with CRLF line terminators
MD5 27002bb346cdc609c41438d18edbf244
SHA1 83cb16cc33e1feacf71a318accb42d334a314870
SHA256 864e5117cdfd019545ec31236f5e976113904a28642eb92082b6f5fb35fee147
CRC32 33CCA3AF
ssdeep 3:jaPFEm8nh3QANX4E4F5cNUqJajaPOUC:j6NqhvXGCNUqOUC
Yara None matched
VirusTotal Search for analysis
Name 49498819e81f807a_C3.bat
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\C3.bat
Size 995.0B
Processes 2544 (4XXR.exe) 2852 (cmd.exe)
Type ASCII text, with CRLF line terminators
MD5 8a560b4acbc0f272b54ac178b05120da
SHA1 3926578aed76d45a2925580745ee9a54f8ee309f
SHA256 49498819e81f807a3d012503aa4115e6a6e22fbf3cdbbcc3b9503df4d66a63b4
CRC32 D9585BD8
ssdeep 24:oupXuvVMNuVhuvVM6tlJO+rydVKIDVMo0AVnoVMQov:ogXYmCYDcdkCpos
Yara None matched
VirusTotal Search for analysis
Name ed50ef8e0b6dd83f_7z.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7z.dll
Size 328.0KB
Processes 2544 (4XXR.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 15bbbe562f9be3e5dcbb834e635cc231
SHA1 7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256 ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
CRC32 01DED2D4
ssdeep 6144:p3sXs8er2d9h6PzeL8fn637DZRC00P2Dky2m2yYjfz+B0iaHxMhoS:p888Ic9UCL8f6/Z1xD2HLH72hoS
Yara
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 15d8615d61ad74ea_12.bat
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\12.bat
Size 607.0B
Processes 2544 (4XXR.exe) 2852 (cmd.exe)
Type DOS batch file, ASCII text, with CRLF line terminators
MD5 d871a911bf684afa46d0323312d2d0ff
SHA1 c54ea1c2eb2a9e22a65066f9f0660af54be1bc67
SHA256 15d8615d61ad74eac48589252ead9f7bb84eef38b83c1d2e17a2d6397cbc2f87
CRC32 A35769F1
ssdeep 12:/+rfrK66lid78FNrfrK66bHidJopkerK66LQAn8pkerK66LDe4TgMAQlrMGJkyA/:afwlI7oJfwTIS9wt89woWxMGJVAvX
Yara None matched
VirusTotal Search for analysis
Name c5e1638b319ea436_Add.ps1
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Add.ps1
Size 1.2KB
Processes 2544 (4XXR.exe) 2852 (cmd.exe)
Type ASCII text, with CRLF line terminators
MD5 1a0567e385d9688760a05576e26de9f5
SHA1 4524380d02e494cd4928346bdc326247a54ea699
SHA256 c5e1638b319ea436e1006558068dce11c59dde887cf84e9daf44557e3fd8e0ff
CRC32 6CD30F40
ssdeep 24:nuMVM80uEWVMuSuvVM+KVMLLvVMp6dsobryDc35VMhVM8EVMqoVMQ:njSrWhSYOSvY6dsobryDc35wemT
Yara None matched
VirusTotal Search for analysis
Name ea2ad8d87b79c8eb_7z.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\7z.exe
Size 71.0KB
Processes 2544 (4XXR.exe)
Type PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
MD5 8ba2e41b330ae9356e62eb63514cf82e
SHA1 8dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256 ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
CRC32 04CAC0A6
ssdeep 1536:6recoyvcrQQqhOH/iBApotp9wsy2GU0vz0Nymg3jqdBaNIvBdh4Yn2Inouy89:lJyErQYH6Jb9m2ewC3++NIvBdh40JouD
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name b7c225ef3cc3e875_d93f411851d7c929.customDestinations-ms~RF16f3724.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF16f3724.TMP
Size 7.8KB
Processes 2912 (powershell.exe) 3004 (powershell.exe)
Type data
MD5 81ca4510272caf505e8091e9a28cb716
SHA1 71414aeec9f1e4a6f5a461b01700cc9cc992cd9e
SHA256 b7c225ef3cc3e87506150eb140e7b9cc127a3469c50a808854acac71a53d98bf
CRC32 FC31E90F
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCwor/47HwxGlUVul:EtCgXoRtCgbHnorLxY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis