Extracted

• • Target
    0902_7410370744.doc
  • Size 430KB
  • SHA256 0405ec33b626eaebad4e45c116d01bd38471398dfc68c7f86de794a3463548a3
  • MD5 b1b1f3740b0ee78deeb1474092d885c0
  • SHA1 1577f2853b6e72a4448ce85e0166be0ea6f728fd
  • SHA512 dfa8a1efd446894cba53652006486c5979654e4af80f77598364bec2862a0d3d77bdfa9e2310342af36a476057efdbfdb9cdbf66ba33a18dcb3de4c55f1f1014
  • MD5 SHA1 SHA512

  Score

  10^/10

  hancitor0109_iqwnmdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2