Extracted

• • Target
    TopjQOYSxpfdTGMA.doc
  • Size 943KB
  • SHA256 36167dcde57f9a12723e0af7f9ea7aba88dd8cc1bdd74b62df1f86aa9d2ba925
  • MD5 45a45e8755d528a77314b2be258614df
  • SHA1 ac76e90a575865376c80a06c9f445110ff9e8819
  • SHA512 47e687de6504ae5ec5eee0f1012c20c7b8cfc35f0efd203718b2c87160c1523087268a50a9a5b7177431325d79da8f7e247f4d5bb4e0dadcd14d5e9c960c0b2a
  • MD5 SHA1 SHA512

  Score

  10^/10

  hancitor2103_punoshdownloadersuricata

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE Suspected Win32/Hancitor Checkin

    suricata: ET MALWARE Suspected Win32/Hancitor Checkin

    suricata

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2