Extracted

• • Target

    MAIL-1992175419.doc

  • Size

    511.3MB

  • MD5

    c8f1b44d361e187573d804e3761f61d6

  • SHA1

    c7e43772e712644bdb957888871649175a5c5c3a

  • SHA256

    5b691a413f46db812da82b2560d6956ad2dc97283b890dab2374d640e289b647

  • SHA512

    7d71220bbc0d673aa4b04f33b8c5b8dc08c1b33b123ff118ffb93101341a39c0cdbe1c7be28772e04a9bfe1311133eb24ab06e26fed2c81ce8eb7e88f0cff0b5

  • SSDEEP

    6144:ip32/gDd0Nmt71wFmSWjfDrV8YQnZocbyrX4NqclWL9:ip32SEmtJwFmhjfPtrXqqyW

  Score

  10^/10

  emotetepoch5bankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2