popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 0275daac1226b684_de96537e.wmf
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DE96537E.wmf
Size 370.0B
Processes 2548 (WINWORD.EXE)
Type Targa image data - Map - RLE 11 x 65536 x 0 +4 "\004"
MD5 c04eb249161372b3ec1102a5f8a38a3e
SHA1 45a7e9fdf9235ee8fdac5bb244e515af89d05909
SHA256 0275daac1226b684ec9845ef32a71c7fd69b2b7cfdd0b27b727a27814626a78d
CRC32 F2488A02
ssdeep 6:M8/kK0Xgtu5S/As0sLk4J/cc26v8VO576u2k8lCKlYEbAKWQ+UgtuYMSVtl:M8/p0v5QosLnP26EVsfDClYExaVtl
Yara None matched
VirusTotal Search for analysis
Name 503d7e04911adc63_msforms.exd
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Word8.0\MSForms.exd
Size 162.8KB
Processes 2548 (WINWORD.EXE)
Type data
MD5 2a9e28493184bd2b8653f4c6485254dd
SHA1 1a880faf5c9905f877cc87a96dfba7a64e9a6331
SHA256 503d7e04911adc63e6e829860789acd44e7191c39d6da738bcb6c5a96a73ef83
CRC32 1D6ED700
ssdeep 1536:IQWueL6wNSc8SetKB4YuiMOqQ/WVMO+O9sOHK7K2xBmsqsDPza7vKp:I+ejNSc83tKBduiMnWOXTK7K1Kp
Yara None matched
VirusTotal Search for analysis
Name 3e21b75231fac502_~$normal.dotm
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
Size 162.0B
Processes 2548 (WINWORD.EXE)
Type data
MD5 28d2506e06a703e89f27dbc0ab1ed063
SHA1 1e21e255b8443cea938b1782f004b17f5a6b1228
SHA256 3e21b75231fac502300774d282ead22d2718c2d41c8eaf7fa617cf770eb07b02
CRC32 66328EB6
ssdeep 3:yW2lWRdvL7YMlbK7lzll:y1lWnlxK7
Yara None matched
VirusTotal Search for analysis
Name 3c18e9e0060d4a90_~$iden.doc
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\~$iden.doc
Size 162.0B
Processes 2548 (WINWORD.EXE)
Type data
MD5 4b7fce596d99ee47a25ba6b97a20fb02
SHA1 f2a9eb98cfcd5e1c636b4353159a201a23b9991c
SHA256 3c18e9e0060d4a90e885055d644a20df46315cf00e0b39ed437803b7df918201
CRC32 E6651883
ssdeep 3:yW2lWRdvL7YMlbK7lhZKQFmjl:y1lWnlxK7R
Yara None matched
VirusTotal Search for analysis
Name a250740948aba579_microsoftwordupdater.log
Submit file
Filepath C:\Users\Public\Documents\MicrosoftWordUpdater.log
Size 327.0KB
Processes 2548 (WINWORD.EXE)
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 0d1dca5eaad49c2dbd979e1bf0b5f8d0
SHA1 f21b1c8c4482392d69725025e82eddd313f48aad
SHA256 a250740948aba579462397ac95ff10e6b0ee952c2af7d9d726cbfde9da1eaaff
CRC32 FF96C440
ssdeep 6144:3g2iqrzOgpZKUb+xLn/8loIZTbSgM8nzMQfdu24T5WL8gPIAO1Goo:31iqbDKUbw/QtbtM8ZF4dQ8gPIkoo
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 4826c0d860af884d_~wrs{bfb6cb33-d795-45a3-83f9-e6d7f4190124}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{BFB6CB33-D795-45A3-83F9-E6D7F4190124}.tmp
Size 1.0KB
Processes 2548 (WINWORD.EXE)
Type data
MD5 5d4d94ee7e06bbb0af9584119797b23a
SHA1 dbb111419c704f116efa8e72471dd83e86e49677
SHA256 4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1
CRC32 23C03491
ssdeep 3:ol3lYdn:4Wn
Yara None matched
VirusTotal Search for analysis