Extracted

• • Target
    0902_5252728028.doc
  • Size 430KB
  • SHA256 5a117ddf8c511f003e4b03027da7e9dd44facbbb5c5e4e63a61e746692e2057c
  • MD5 b1753a871800898ebe11813df769c4ec
  • SHA1 319ba1d6b4e3f1a5e0f3c19ff06ce0a32bb69afe
  • SHA512 670edcba7011c2b9a0eb4207adf5efd2f2a03f50fe4b3c3952ad048d0a9b69b8d022a9ccefa782ca1b93ee7cac59274c635a25dff4b1a2e56cb311209a1dbd2a
  • MD5 SHA1 SHA512

  Score

  10^/10

  hancitor0109_iqwnmdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2