Extracted

• • Target
    0902_6686864155.doc
  • Size 430KB
  • SHA256 2c4557c9b0b5f18c6cffb810cbbb07601ae0b1b071658611523bf980d814d7b8
  • MD5 b4095bc22ff3f27dd088852a49338c08
  • SHA1 fb5d1506454a79cc41086d65e6f72a4493185f3f
  • SHA512 cfc4199107a18bdd98c1ebc1a7c62040a5632a1fbcdfdbbb7ff5f715196d6e26659f4eccbc5645c4f61a25c393717ad320ef173a6c65341c0407cf0a45f4850b
  • MD5 SHA1 SHA512

  Score

  10^/10

  hancitor0109_iqwnmdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2