Extracted

• • Target

    MAIL_6198405036.doc

  • Size

    539.3MB

  • MD5

    611b3017ce676491ad9313fcfaadc0b8

  • SHA1

    75736c632c339532414f721ea2a1c44075e53734

  • SHA256

    882fa5f71902181ce1bc015c26033d9d1de708d393212b2d3bdcf42d1bf0d412

  • SHA512

    02f47bacd6004b99f67ebcd75f050d74dcb46e5ebc60a7d5490365425d33f55875ea48dd00af125274fa380d5d18c9db373d62bf8eecc4be7dcd878a9b621225

  • SSDEEP

    6144:ip32/gDd0Nmt71wFmSWjfDrV8YQnZocbyrX4NqclWL9:ip32SEmtJwFmhjfPtrXqqyW

  Score

  10^/10

  emotetepoch5bankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2