popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name a7f1e9fe8815c134_hf2c9taf.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\hf2c9taf.out
Size 598.0B
Processes 2948 (poWeRshELl.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 5352268aca801f9bd499520da7c6904d
SHA1 58b3b96f7d7e5c44736378a4bb13c9352132d1d1
SHA256 a7f1e9fe8815c1348a8ebf8a1f01f573a46bda3e7a263f8b15366127347dfbf6
CRC32 0564B80A
ssdeep 12:K4X/NzR37LvXOLMT1nPAE2xOLMTDKai31bIKIMBj6I5BFR5y:KyNzd3BT1nIE2nTDKai31bIKIMl6I5Da
Yara None matched
VirusTotal Search for analysis
Name 4757b201d8b76542_hf2c9taf.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\hf2c9taf.pdb
Size 7.5KB
Processes 2316 (csc.exe) 2948 (poWeRshELl.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 f9f43f847423ba0d3033338975222baf
SHA1 13b31c63fae28cee6e5cf7de99393d20f98a4ca5
SHA256 4757b201d8b765423ef6e18c5eaba09291d9374f7eb86453012efde395e159c9
CRC32 522DDB5B
ssdeep 6:zz/BamfXllNS/S6GxW/P1mllxrS/77715KZYXN6Gx0kMoGggksl/3YXBGQu+e0Kd:zz/H1W/S5MtSXS/pwy5OkMmqRi
Yara None matched
VirusTotal Search for analysis
Name 2a547e24bff929fa_hf2c9taf.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\hf2c9taf.cmdline
Size 311.0B
Processes 2948 (poWeRshELl.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 aaa98e2ee82d1992f52e987c1650a55d
SHA1 ef9d2fa0e849104e8fb1fb5b4935869cd17a9e01
SHA256 2a547e24bff929fa46ab3348f770802315c6111cccddc1e4a69ab75713e17927
CRC32 A47B31CA
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fb8wmGsSAE2NmQpcLJ23fbKn:p37LvXOLMT1nPAE2xOLMTK
Yara None matched
VirusTotal Search for analysis
Name 1becdd798fc92d55_hf2c9taf.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\hf2c9taf.dll
Size 3.5KB
Processes 2316 (csc.exe) 2948 (poWeRshELl.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 f6007bc7d82ec0053b287b158aab6e28
SHA1 79955242d46cd531f5e0bddb061a954567b0e83a
SHA256 1becdd798fc92d55cc7925276f392055d01826e2ccd0be052a29eb188c860e8e
CRC32 32F7EB21
ssdeep 24:etGS1eN6G7wcp6wSgkqITK1TyUbdPtkZfdpXc81WWwoTuGmI+ycuZhNfakSRPNnq:619/9wyMuJdpXc85woO1ulfa3jq
Yara
  • Network_Downloader - File Downloader
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name 08dc6fdce73c374d_RES1D91.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RES1D91.tmp
Size 1.2KB
Processes 1736 (cvtres.exe) 2316 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 ea79d94b8eec220934899db5f4674f20
SHA1 0a2ed785b2e080ae39961782e05a6cb167ee0aef
SHA256 08dc6fdce73c374dacd606fcb0baf33706d86e441164273bbcd39b7d6a2fd012
CRC32 1E6D8BC3
ssdeep 24:HpgJ9Yern3gUPmHxoUnhKLI+ycuZhNfakSRPNnqjtd:Jxern7mRDnhKL1ulfa3jqjH
Yara None matched
VirusTotal Search for analysis
Name 2973547b42a9302e_CSC1D23.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSC1D23.tmp
Size 652.0B
Processes 2316 (csc.exe)
Type MSVC .res
MD5 bd950e8313a5a6a95efe20d6b068f74b
SHA1 7a103358418b72a9917d319a3fa685f4769728a1
SHA256 2973547b42a9302e14733f72861dd122e5ad288b60aa5b6e7ca57ae61db5aead
CRC32 70DCF1F3
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry8bRqak7YnqqfbRbPN5Dlq5J:+RI+ycuZhNfakSRPNnqX
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_hf2c9taf.err
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\hf2c9taf.err
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 2c6aa2d177c12b8b_hf2c9taf.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\hf2c9taf.0.cs
Size 468.0B
Processes 2948 (poWeRshELl.exe)
Type C++ source, UTF-8 Unicode (with BOM) text, with very long lines
MD5 6df86e1fc32232670895b645d343cc19
SHA1 297afb3e80cba2081951ba1f80622ae0e30e6ba6
SHA256 2c6aa2d177c12b8b72d62d6e89fb61f847c2b5e79a6540b5e23a9584c9b01a31
CRC32 DF169C1C
ssdeep 6:V/DsYLDS81zuu5dyUMORQXReKJ8SRHy4HEhKmAvlRTlF/0Jsc8Qy:V/DTLDfuu5dxWXfHUKpTey
Yara
  • Network_Downloader - File Downloader
VirusTotal Search for analysis
Name 44e8aa0601fffe82_590aee7bdd69b59b.customDestinations-ms~RF16fe892.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF16fe892.TMP
Size 7.8KB
Processes 2948 (poWeRshELl.exe) 2432 (powershell.exe)
Type data
MD5 ee6cfd78f72f03663db2a7df0c696dd7
SHA1 56126e81a5f6577f8e24a890185d0c9eb600fa02
SHA256 44e8aa0601fffe82c494bbc7d7280aa3bc5e90effe2aee2d716d5716e1d6b568
CRC32 F27137C4
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCworu4tDHXyGlUVul:EtCgXoRtCgbHnorBTyY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis