Extracted

• • Target
    20210824_172244_3690c536daaa03d499cac0d06c41dd50260bd061cd9c930185b5556bfd52dfe5_0824_8518132766.doc
  • Size 623KB
  • SHA256 3690c536daaa03d499cac0d06c41dd50260bd061cd9c930185b5556bfd52dfe5
  • MD5 2a611bc2758fcbadd5c91a6cf938e918
  • SHA1 84ddcfd73db90ba299d3ead61a4b7eca048dfac3
  • SHA512 4575ba584aae6882e9dc428f0b39f030f0d6fef9809128decfa8cceab183999aade0dbe138ce685725c9d28aa7888bada925c796422be8cfa3368d60957e5137
  • MD5 SHA1 SHA512

  Score

  10^/10

  hancitor1908_jkdsfdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2