Extracted

• • Target

    1123_2339546126972.doc

  • Size

    893KB

  • MD5

    ca52b8e88308d2d3147b0721d6d72626

  • SHA1

    e91c2de24abae6a37f6572b70685a3ce25fe821e

  • SHA256

    a2903ebc67c3549f59ecf6718444f6826030fa29f3701460b9709edbd9aa675b

  • SHA512

    763d1205b1dcb84ffbf59f1ff61a62175a058b6c2d5994d5575ad900b195ee74a085937c6dc669ddb42a2f6a7f45f391d0e4c0b10307ec860ef52c7991f3b6b8

  Score

  10^/10

  hancitor2311_nsdirdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2