Extracted

• • Target
    0902_2448248612.doc
  • Size 430KB
  • SHA256 c5348082bf94a5c954acc7b7f14b4492612a46c27f92cf49cf04b8e72fba181f
  • MD5 e386dac416cc30f90a1a25d867896692
  • SHA1 1a6b4463569d18f762d6f0b083f18bb400c2f6d8
  • SHA512 b082f13c8e2b9b6a66b51f00e96a83daaf454e8be36f45c06d14387e6f55657d8ffee3bae3c14d408ebea2f9a932d53fe1fc77b55c7f116fa8ba5ae99a9517e2
  • MD5 SHA1 SHA512

  Score

  10^/10

  hancitor0109_iqwnmdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2