Extracted

• • Target

    3f30b5d11a54e6e7c208c70d518e20dd.doc

  • Size

    892KB

  • MD5

    3f30b5d11a54e6e7c208c70d518e20dd

  • SHA1

    8f71e7b756d215ff74f84d56a84ee71245dd5510

  • SHA256

    1330a9b1b83a5956ebb74c44a84673a35c1e84a078911e6de6b9a85f8fd80823

  • SHA512

    00d6d7fb0c95f4f30528fdd463f2141fd81b4c0a189a4da84bbe45a40e8628e11c31836b9f41caf7ef2a2e96dfee2ec282158598497bb64f61615884478dbc97

  Score

  10^/10

  hancitor2311_nsdirdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2