Extracted

• • Target

    INFO_1703.doc

  • Size

    538.3MB

  • MD5

    5764499b0b78bbfede5bfb20c9a6bf1b

  • SHA1

    4054d73b5d800a6635ae840758743ab6848bd56d

  • SHA256

    b0464d4fce9faf96fbf8bce0c6d5c34db234a1985c086ae5f4cb145a78f1c06b

  • SHA512

    d1db611db0b327695ad3636793816c47c05cdee2396d1eeaac8fc791779d7d6e9ece129adcf4abbb65e9f136426455de3afe38b4f2c5a624c72cc1448c3e0b94

  • SSDEEP

    6144:ip32/gDd0Nmt71wFmSWjfDrV8YQnZocbyrX4NqclWL9:ip32SEmtJwFmhjfPtrXqqyW

  Score

  10^/10

  emotetepoch5bankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2