popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 17f746d82695fa9b_alpha.exe
Submit file
Filepath C:\Users\Public\alpha.exe
Size 295.5KB
Processes 296 (extrac32.exe) 2192 (cmd.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 ad7b9c14083b52bc532fba5948342b98
SHA1 ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA256 17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
CRC32 C1BA11D1
ssdeep 3072:H/Fkbff/FoeMrx9O1vfjQdLCQMcP7FRCMkLjyGez1c:H9kbtoLtM1nM9xf/CMkLmt+
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name ec40d197542cb9c2_Ping_c.mp4
Submit file
Filepath C:\Users\Public\Ping_c.mp4
Size 2.8MB
Processes 1880 (kn.exe) 1164 (alpha.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 687fd2aa9a6b4ae6e6fcb4398f77b5ed
SHA1 f688a4f516a6d136c3e006e9ad71fe66340ba743
SHA256 ec40d197542cb9c2f33b5ba840cc8b07f4f611f4c436455b0e1dd967eef057b7
CRC32 7612D0A3
ssdeep 24576:UIjMKEr6BetTyfzJjCa3RWakbq9Pjmw5i2FE2Ms6DOl4JG3vlfzuoxTQL:a
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
  • anti_vm_detect - Possibly employs anti-virtualization techniques
VirusTotal Search for analysis
Name e3b0c44298fc1c14_cer2E4E.tmp
Empty file or file not found
Filepath C:\Windows\cer2E4E.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 6c05e11399b7e3c8_xkn.exe
Submit file
Filepath C:\Users\Public\xkn.exe
Size 442.0KB
Processes 2560 (extrac32.exe) 1844 (alpha.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 92f44e405db16ac55d97e3bfe3b132fa
SHA1 04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d
SHA256 6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7
CRC32 73932221
ssdeep 6144:+FYRyCXBgoDhzoNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqOm:dRZgQhIKXzJ4pdd3klnnWosPhnzqN
Yara
  • PE_Header_Zero - PE File Signature
  • Antivirus - Contains references to security software
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name e0bccdfe680a7010_ping_c.pif
Submit file
Filepath C:\Users\Public\Libraries\Ping_c.pif
Size 1.4MB
Processes 1652 (kn.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 57fc458930e5cfd9263ea5a0e746e113
SHA1 4ea6b720414b3c69493aefe8a4660509ff365a5f
SHA256 e0bccdfe680a70103b264f217d64973409ee5206f2a51f26ac372640a61c69c0
CRC32 F9A45DBC
ssdeep 24576:h4QdcyXLJzOXVbl/41acOSYrkjX/Mv4L2z3/7zXedU+rcuDYm+7etOY7OhWP6PZr:CQ/yF41acOSrYvZzv8+fm+7etlWWP4Ce
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • mzp_file_format - MZP(Delphi) file format
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 36414c7e57afa613_ger.exe
Submit file
Filepath C:\Users\Public\ger.exe
Size 61.0KB
Processes 2132 (extrac32.exe) 2252 (alpha.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 d69a9abbb0d795f21995c2f48c1eb560
SHA1 8bd131b03d6ba865b228ca8ee3239d2ef2b90b74
SHA256 36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a
CRC32 872C1B2B
ssdeep 1536:LB9b/srNIktO/LayPO6lZtmVE7JvpUcuLgpq064Qk:HLsrStJPuLgE06t
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 589229e2bd931000_kn.exe
Submit file
Filepath C:\Users\Public\kn.exe
Size 869.0KB
Processes 1196 (extrac32.exe) 1648 (alpha.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 7b973145f7e1b59330ca4dd1f86b3d55
SHA1 10ce9174bff4856083e6adad0094a798ced2c079
SHA256 589229e2bd93100049909edf9825dce24ff963a0c465d969027db34e2eb878b4
CRC32 6F3940A1
ssdeep 24576:gLByfEWXrGU3Vrzll/POE7gLtk+oOg3uOvb725m:gV+iU3j7chk+w39z79
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis