Dropped Files | ZeroBOX

Name	9fbf0748b5d890c2_InnoPack.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\is-TBD47.tmp\InnoPack.tmp
Size	3.2MB
Processes	2552 (InnoPack.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`e587511f17c07622f2e88bde6dc2a499`
SHA1	`08899e43445db2e0d000b3afd80e028636786eeb`
SHA256	`9fbf0748b5d890c2c28b1ae20aad7fc23a93cc7a57c4a51220d9381af7637c60`
CRC32	`BF4B7E01`
ssdeep	`98304:nJYVM+LtVt3P/KuG2ONG9iqLRQE9333T:2VL/tnHGYiql5F`
Yara	Malicious_Library_Zero - Malicious_Library Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	237d1bca6e056df5_vucakq.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\is-JUJJ4.tmp\vucakq.exe
Size	872.7KB
Processes	2632 (InnoPack.tmp)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c56b5f0201a3b3de53e561fe76912bfd`
SHA1	`2a4062e10a5de813f5688221dbeb3f3ff33eb417`
SHA256	`237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d`
CRC32	`76090EE7`
ssdeep	`12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	2eee2e7fad833ed6_script.a3x Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\is-JUJJ4.tmp\script.a3x
Size	654.6KB
Processes	2632 (InnoPack.tmp)
Type	data
MD5	`742a52bfcedea23ed2ede23d0e7a5f7c`
SHA1	`dcbb13387ca5d6e73df278eee0455f51c1e1ae42`
SHA256	`2eee2e7fad833ed6297f8d8b28e119466415d702f63d9e52d88d1bbe7ec02811`
CRC32	`2B047411`
ssdeep	`12288:ngLrlRgozxVLc0bAwBbPoeYC5tQovkgzaGwaEVzq+6nqmRwCSsqThNip3Phv4P8U:nAJeozxxvDwaEtq+6nzRwCWT/i1PwL`
Yara	None matched
VirusTotal	Search for analysis

Name	388a796580234efc__setup64.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\is-JUJJ4.tmp\_isetup\_setup64.tmp
Size	6.0KB
Processes	2632 (InnoPack.tmp)
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`e4211d6d009757c078a9fac7ff4f03d4`
SHA1	`019cd56ba687d39d12d4b13991c9a42ea6ba03da`
SHA256	`388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95`
CRC32	`2CDCC338`
ssdeep	`96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) UPX_Zero - UPX packed file
VirusTotal	Search for analysis