Dropped Files | ZeroBOX
Name d6431d5645fffd05_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2228 (powershell.exe)
Type data
MD5 260d23ce04a8f8555a73b7d2dc15e911
SHA1 ebad746fb7de847c50f7502a44f6e35534733efd
SHA256 d6431d5645fffd05a23166d630253bc7ce8c099cf6e9c956f8ae5e1249ee8588
CRC32 11D6B213
ssdeep 96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ctvXo5tvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF2027eb1.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2027eb1.TMP
Size 7.8KB
Type data
MD5 b0c9ff441742f3847ea27da9dee7f2cd
SHA1 c42a1eb32ba953a0ce5d8635caabf71b5b281495
SHA256 a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4
CRC32 0BBCAB1A
ssdeep 96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name d03f50f4bec5c21a_x64.bat
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\x64.bat
Size 13.4KB
Processes 1940 (utility-installer.tmp)
Type DOS batch file, ASCII text, with CRLF line terminators
MD5 0af5e38f3e1912e241ce4911c4fa10fc
SHA1 faa8a40c60e2d87db70d28f9a3010faa7fcff9dd
SHA256 d03f50f4bec5c21a9a7b3abc9db320f3f3edda5a868ed359381e5fb0fd506133
CRC32 E390767A
ssdeep 192:Yy1hOtrI2rw8WWZAYEli8pObJ/Cq/Q8MaOXz8Z28HO/pkV+8XO4YQlyv:Y1rZAoJAtzGo
Yara
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name 54e7e0ad32a22b77_idp.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\idp.dll
Size 232.0KB
Processes 1940 (utility-installer.tmp)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 55c310c0319260d798757557ab3bf636
SHA1 0892eb7ed31d8bb20a56c6835990749011a2d8de
SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
CRC32 E86B363C
ssdeep 3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 5a2054e350c605f8_onesave.ps1
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\onesave.ps1
Size 8.8KB
Type ASCII text, with CRLF line terminators
MD5 b1089a787ee5cbca9d428d3b36653b6d
SHA1 193b515909b6fa88200d1a1b025425120031c6b4
SHA256 5a2054e350c605f851be48c330473dacaff5623c2eb394235fff183b22362e38
CRC32 3F5897DF
ssdeep 192:opO/rOZZ0y+Q3cO1JcZqYO53TkORlnuOqq3m:o0KZSy+Q3FJcZq93TJln8q3m
Yara None matched
VirusTotal Search for analysis
Name 388a796580234efc__setup64.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\_isetup\_setup64.tmp
Size 6.0KB
Processes 1940 (utility-installer.tmp)
Type PE32+ executable (console) x86-64, for MS Windows
MD5 e4211d6d009757c078a9fac7ff4f03d4
SHA1 019cd56ba687d39d12d4b13991c9a42ea6ba03da
SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
CRC32 2CDCC338
ssdeep 96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name e3b0c44298fc1c14_start
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\start
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 7f571babe4c02579_utility-installer.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-QUJ1E.tmp\utility-installer.tmp
Size 3.1MB
Processes 1836 (utility-installer.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4476739a35103790cb0843ebd167d77b
SHA1 101758102639bc45de23a2fa93bafa4f99b86447
SHA256 7f571babe4c02579664c2a1d18939a3838d8002cb9a554c1e565b13f8015051d
CRC32 05E7C7A6
ssdeep 49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis