popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 0df3d05900e7b530_185.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\185.exe
Size 70.5KB
Processes 2916 (updater.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 ca96229390a0e6a53e8f2125f2c01114
SHA1 a54b1081cf58724f8cb292b4d165dfee2fb1c9f6
SHA256 0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c
CRC32 386C60A5
ssdeep 1536:tjL6b1xoQ66K+jLMqPHULq87qdGN2B30GfDQ+1FIRXWHH0:t0BVbjQaNpd82xpLQ+126H0
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 798af20db39280f9_sqlmap.dll
Submit file
Filepath C:\Program Files\Microsoft DN1\sqlmap.dll
Size 114.0KB
Processes 2916 (updater.exe)
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 461ade40b800ae80a40985594e1ac236
SHA1 b3892eef846c044a2b0785d54a432b3e93a968c8
SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
CRC32 CF004A91
ssdeep 3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE64 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 225700ea7b55e3d8_programs.batXstart
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start
Size 80.0B
Processes 2616 (updater.exe)
Type ASCII text, with no line terminators
MD5 e7b352f577a25aac64a19dc23abd2c71
SHA1 91563e25a876b3c8884deb8b51772ba547f49415
SHA256 225700ea7b55e3d89d0dd59da04e5007c3149c62961c6550bbee0c69c67bab63
CRC32 B7507613
ssdeep 3:eGAjGJw1mWxpg9l+3dAlbVJHERMQhM:ZuGJw1mQpS0ABj
Yara None matched
VirusTotal Search for analysis
Name 1ac6a05f2fe3b95d_programs.bat
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat
Size 141.0B
Processes 2616 (updater.exe)
Type ASCII text, with no line terminators
MD5 aafe63c0e3a10ecd523de79d0c2f2400
SHA1 b6aa19f83e8bb50461369bf51360d7ff736ccf18
SHA256 1ac6a05f2fe3b95dd31f9bbdab33222a155f3e2311f42852d993fadd0bea3f48
CRC32 2A9FF243
ssdeep 3:QwZ2vOUrKaM6eNGRjDmWxpcL4EaKC5SufyM1K/RFofD6tRQLRWLyLRHgn:QElPhxumQpcLJaZ5SuH1MUmt2FWLyS
Yara None matched
VirusTotal Search for analysis
Name 32ff81be7818fa71_rfxvmt.dll
Submit file
Filepath C:\Windows\System32\rfxvmt.dll
Size 36.5KB
Processes 2916 (updater.exe)
Type PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5 e3e4492e2c871f65b5cea8f1a14164e2
SHA1 81d4ad81a92177c2116c5589609a9a08a5ccd0f2
SHA256 32ff81be7818fa7140817fa0bc856975ae9fcb324a081d0e0560d7b5b87efb30
CRC32 40B5B78C
ssdeep 768:2aS6Ir6sXJaE5I2IaK3knhQ0NknriB0dX5mkOpw:aDjDtKA0G0j5Opw
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE64 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
VirusTotal Search for analysis
Name 2de7c3db2e91021b_rdpwrap.ini
Submit file
Filepath C:\Program Files\Microsoft DN1\rdpwrap.ini
Size 275.6KB
Processes 2916 (updater.exe)
Type ASCII text, with CRLF line terminators
MD5 4d18179c3e64e912a2ecd80a8aed4aa7
SHA1 1330011d2f45017c5991e681fd1dfceaaff268bf
SHA256 2de7c3db2e91021bae6e16d67677ea9ef123809eed237f804d4f7b3c0315ba5c
CRC32 65C6979A
ssdeep 768:EUiQVQpXQq4WDi9SUnpB8fbQnxJcy8RMFdKKb5x8Rr/d6gl/+f8jZ0ftlFi4Q7QT:c033L+MAIiG4IvREWddadl/F2
Yara None matched
VirusTotal Search for analysis
Name b7c225ef3cc3e875_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2960 (powershell.exe)
Type data
MD5 81ca4510272caf505e8091e9a28cb716
SHA1 71414aeec9f1e4a6f5a461b01700cc9cc992cd9e
SHA256 b7c225ef3cc3e87506150eb140e7b9cc127a3469c50a808854acac71a53d98bf
CRC32 FC31E90F
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCwor/47HwxGlUVul:EtCgXoRtCgbHnorLxY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis