Extracted

• • Target

    Invoice No 526807 March 23.doc

  • Size

    517.3MB

  • MD5

    bcae0aca1a3b2df9d5e85de2ed3666e9

  • SHA1

    f56c3b72b7e8c55b9685e35765553fafbbb08e2b

  • SHA256

    5a092b0034f937f68ad7e5679ed840039fb824df8cad8f74b890cb7f4e42f0cd

  • SHA512

    4162200952e62402a6085ae5f1342a5b35d59f52a5ddf54d9eea3d318f62df9ca308cfc3e079cca484ab38af1ed17fa68fe9ad0c9541ff483aa3de20fff44afa

  • SSDEEP

    6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

  Score

  10^/10

  emotetepoch4bankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2