General
-
Target
0113_88514789.doc
-
Size
633KB
-
Sample
210113-cn7jewmgqs
-
MD5
e920a98ccda2ecf95cca8e6d4e66e0ac
-
SHA1
e39ee8709a55f915446d4d22d581aa03422b6378
-
SHA256
40c3eb22a02601cf70a4ae08eeaa5805144386bc13882e5f110c133b1d0ede8e
-
SHA512
55948ee47c7e22fafef4b387047312699c926f7fae0cb8d08fdc0c761abd146ba52a712873d13ef980309e981102e07608f65a10236765a5791bb4fc26387965
Malware Config
Targets
-
-
Target
0113_88514789.doc
-
Size
633KB
-
MD5
e920a98ccda2ecf95cca8e6d4e66e0ac
-
SHA1
e39ee8709a55f915446d4d22d581aa03422b6378
-
SHA256
40c3eb22a02601cf70a4ae08eeaa5805144386bc13882e5f110c133b1d0ede8e
-
SHA512
55948ee47c7e22fafef4b387047312699c926f7fae0cb8d08fdc0c761abd146ba52a712873d13ef980309e981102e07608f65a10236765a5791bb4fc26387965
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-