Extracted

• • Target
    Billing Invoice - Job # 4712264.doc
  • Size 86KB
  • SHA256 1f33a3b176c7062a63b392a64c21e5c05bcd0c920a363bbcde4a1a0bc9ad2b8d
  • MD5 2d2b0c7b4325da2fa989ea8ac308697b
  • SHA1 5f182251f6c4bb194b780737445816745343fdd1
  • SHA512 4a9a94851f88b0502888fbc125e6c4a82cb36a6c2e0495855580b483133bf7657e3159b23883b2fe8024c2af3548fb1f1490788d0a3f65ed3f4645bcc9f372de
  • MD5 SHA1 SHA512

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • An obfuscated cmd.exe command-line is typically used to evade detection.

  behavioral1behavioral2