Extracted

• • Target
    0902_4553378130.doc
  • Size 430KB
  • SHA256 f7ce91a8b79c49d2e22cb3f00e838411866e1ae089712d621c4a3d53faa9e78a
  • MD5 72a4fa5a85a6fd12092e53144303223d
  • SHA1 783946dfed63f05f5c459d3713acdeeb83c13a2a
  • SHA512 5b7f04259a3af5a4c72821acab32bc8fd7ba9a7fe8a2c75b9aaad9d34cad22e4ab8801068d3f45df70311690b9963687be1c15dd2f533ebd1991e2b9cfee8962
  • MD5 SHA1 SHA512

  Score

  10^/10

  hancitor0109_iqwnmdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2