Extracted

• • Target

    1123_2275053369078.doc

  • Size

    892KB

  • MD5

    e7d0b5ca9ea7b5a9eb7457291d3bbcc0

  • SHA1

    c8a10060cf3f0e41e67d39eb5ba88602c174e9db

  • SHA256

    5f4e57986604f7caf6831a25d3b53542d2665dedc0fedb8fc59dd72a914b0963

  • SHA512

    a0fc1cbb5c906e9c248c881818c23ee2f78a209027fb1d05ddd7e6960c96a18866e891fac69c892128af0bfb65e287921402b225cc5223e083ff11b05f20fed6

  Score

  10^/10

  hancitor2311_nsdirdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2