Dropped Files | ZeroBOX

Name	b2af968437784b2c_PO.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\RarSFX0\PO.exe
Size	855.5KB
Processes	2556 (PO.pdf.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ebd47ffed3bf53676411aa46cb93e0bc`
SHA1	`0a3fed2d4e7e4a28f736c78c29a7f03f45aa6921`
SHA256	`b2af968437784b2c1b3455599a9ac5fa2451a6a89f1b6b09243ac13d8c330270`
CRC32	`E9C9FDC3`
ssdeep	`12288:nHS95Eu4x2ev1ls3k/KVgET+j0pUg5N4IsF7gJkgOxwr:nHSKv1l3ygCpxW`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
VirusTotal	Search for analysis

Name	e3b0c44298fc1c14___tmp_rar_sfx_access_check_24061640 Empty file or file not found
Filepath	C:\Users\test22\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_24061640
Size	0.0B
Type	empty
MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
CRC32	`00000000`
ssdeep	`3::`
Yara	None matched
VirusTotal	Search for analysis

Name	7ebfb9a597f440dd_PO.jpg Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\RarSFX0\PO.jpg
Size	294.1KB
Processes	2556 (PO.pdf.exe)
Type	PNG image data, 1576 x 1102, 8-bit/color RGBA, non-interlaced
MD5	`6eba73046de81f32f298c28e88a029f2`
SHA1	`4107482ab3fffb246b8fbeaedfc98183d6613a1a`
SHA256	`7ebfb9a597f440ddfa0b9af12425a156475329e4d2cfbc873c244269fd72ac62`
CRC32	`7BF7781D`
ssdeep	`6144:+gEcv4nUX7UTeYZk/elD7tEnzUFeDBm/rqPse12l8+rADlNh5ZH/PF8M5A+:+gwnq0ZZvv4mTqPsc2yM6lNhfH/P+r+`
Yara	PNG_Format_Zero - PNG Format
VirusTotal	Search for analysis