Extracted

Extracted

• • Target

    kinizamail-doc-09.26.22.doc

  • Size

    867KB

  • MD5

    127a837bbe912f144fd3c98148308459

  • SHA1

    06d87666a996908807e373a9a7569f24cf6c2e17

  • SHA256

    0b1b3f889461485e71868160f46aeb008d8dd68c44b7b2e2f6f2c3e8831aae8b

  • SHA512

    0cf93803d016f5694e2d428845bdfb582538a91b0d61e17883283f8a982384c6ab30e72fac6aad7cd5d60e26bc96dc24754b140127c1768bd532f8a7d57e5b61

  • SSDEEP

    12288:0PVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEzhkmuVOkGnC6XAaunP5Gt2:oV2jUeQRI5wPN/+kmZDBwaux

  Score

  10^/10

  icedid742081363bankertrojanloader

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  behavioral1behavioral2