Extracted

• • Target

    dd5a2731ea158f234836d90487f79adfae8b93f5b7f847dbb6cd4d766037e46d.xls

  • Size

    217KB

  • MD5

    c083c71b2b156ae6e42ccd7c0c352c12

  • SHA1

    b1dda95b6068715571b73bde920a6eba08335107

  • SHA256

    dd5a2731ea158f234836d90487f79adfae8b93f5b7f847dbb6cd4d766037e46d

  • SHA512

    94d6f837298c70ccab68bc2fe7d75cc02f1fb238ca28641df27a12b733ce216d2a169143b499faca6f06d4159c2b8963afbc9fa6788752202467c435aa8380cc

  • SSDEEP

    6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg8yY+TAQXTHGUMEyP5p6f5jQmt:nbGUMVWlbt

  Score

  10^/10

  emotetbankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2