Extracted

• • Target
    unk.doc
  • Size 1.2MB
  • SHA256 cc8cf94bf0e2f1aea0b12b84fb682afa2c268b05262748b374f36c010c5af9af
  • MD5 c3cce33021d652283d045dca9dcff774
  • SHA1 76a34575ce562009107ff58dd4c778c286429c74
  • SHA512 ea22bf734a8be3c999a2685ba1b467273ca69e78a0f01e1acc6b199e9c5b6e6e21da8f414657ecc846c2ffc6dedb1ffb6ee7af1dd406d865150b205648a7fd75
  • MD5 SHA1 SHA512

  Score

  10^/10

  hancitor1506_necixdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2