Extracted

• • Target

    4696233109873277.vbs

  • Size

    870KB

  • MD5

    8e73555843a4d416c21103d61f550dd0

  • SHA1

    3562e225fdd65276810cfcf9d168c616179af7c7

  • SHA256

    8b9ca248a7c278592ff4096afb155b605cfb60d5559173bea494961b7ff7056e

  • SHA512

    d898bdd95d591efbfe965fadbb2117b7d38ab9a241ea3b91dc4da3049b55d56c741aeb1f8814efbe589ebe2db0525ce8c6aef658ea31b0530d1b73adc59b832b

  • SSDEEP

    24576:96lLg+R5WZdswPhE31UTfnPItO9wBRPnkDsWhwDRVV2Omn:x

  Score

  10^/10

  hancitor0512_54355435downloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2