Extracted

• • Target

    _2866571907494.vbs

  • Size

    579KB

  • MD5

    d4bfbd62db6574ae4a90a0c2a9fd8427

  • SHA1

    cc7c9ca8679b2efe00d18048b8a0beadc2d53cc9

  • SHA256

    13aa175c12cd675b2a32d5bd252d35352811a036046e042ac5d1454957972bee

  • SHA512

    f8cfc582aad8e09685538e1059d1e4ce154043e12ae477b809391ebaac777bc38eda82b6e4e1c282808702ef80f128d17714d4c43510653fd0929529ed1ce009

  Score

  10^/10

  hancitor1212_78342432downloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2