Extracted

• • Target
    0818_4630283540.doc
  • Size 612KB
  • SHA256 5106d27c6ad307b79bc3d86678dcaef8e858335afc8a0bc801c205778ae93184
  • MD5 6e2218d9db39b1f530926a382f192804
  • SHA1 5e0d259843f6160b40b85ecc9994383b77d39098
  • SHA512 87fbe92a6d98fe03f6fe85230880c783879920542da0ab5ca833292c54533b3a11ba6d337d08c804f7393c145dd8aef1e1138307b6ba06798b9bf0ffd3ede1dd
  • MD5 SHA1 SHA512

  Score

  10^/10

  hancitor1808_plfrdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2