Extracted

• • Target
    0913_2985111453895.doc
  • Size 489KB
  • SHA256 dd3ef1d4374dd7dc49463c38c92376a9f88e795c00a59bb33c28bc9513e50940
  • MD5 56b05af86e5eabfaf09116b9355c7320
  • SHA1 f2b4c687335ee1ee7786abe53c52e8817924e1dd
  • SHA512 aa1b1fa8b3c4fdf18a4f6d8431e8445ff730f359b4b0cd7cb8fb682c3c62beafdc49091fb01466a6e9fe58ea2d3feef68c0b33128eb56fd98dfd1313ce7ea153
  • MD5 SHA1 SHA512

  Score

  10^/10

  hancitor1309_memqdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2