Extracted

• • Target
    lightlink-doc-09.26.doc
  • Size 867KB
  • SHA256 e269a681bba217da4d23d53a8cb44c19d502af3a25b37c416e0d5f273caf589e
  • MD5 55656aac9077222bfb6c1f9329430a62
  • SHA1 b437d4442846fb0605eccfe55644c715dd4ace4c
  • SHA512 c94ab979d7e2ecdee43bc9edf4117c904c538c612cbf88dfdfb5dcff3d25b2c88b7966145353b18d50b889fe4e2ce19385d03950a361db2da92f7ac281b915ac
  • SSDEEP 12288:XevVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEuXmu5GYAH7og1ANO:OvV2jUeQRI5wPN/hmu5iEQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  icedid742081363bankerloadertrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  behavioral1behavioral2