Extracted

• • Target
    0817_3885680415.doc
  • Size 837KB
  • SHA256 99b6ae648c779e65aacd21d02be4e64bb2ad894690a03cd89515b100c1273a70
  • MD5 0753f1dd26d5baf0b87d7a814937a8c2
  • SHA1 7f2baabc3d8bd68a59cad677345219f1fcaa00de
  • SHA512 271c1720a7ff2301e338dcc728310dfa438083118cc26dc24d00246232b493a42d5a17ba254767289801a359de4998aa1f758a4d445af00371a9211f7c1c4fb4
  • MD5 SHA1 SHA512

  Score

  10^/10

  hancitor1608_febddownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2