Extracted

• • Target

    1103_2096072643613.doc

  • Size

    575KB

  • MD5

    3247dab6d560e5cf05bbe610c3f92da6

  • SHA1

    824cd25d1cc8b8092f90dc6dfc80f867caae49eb

  • SHA256

    795469e3d20d8b1e85816f14cd122796ca9dfe2947a4c9fe1464d62900f10d52

  • SHA512

    50872742f94e6ecf3b2ead4500b105ff9ee3c3c36c34dc1510d15957b1a5c2bc213203147b1b8f3a42eb6d58b8dcbc0d6597e2fe7c83fe5981b8b76c129ad3c2

  Score

  10^/10

  hancitor0211_ponxwedownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2