Extracted

• • Target

    Notice-801976.doc

  • Size

    502.4MB

  • MD5

    758d5e55b9ab13a7c5d27eb02225dd71

  • SHA1

    737e54c00e7cb3d5d60accfeb9330418c37e9441

  • SHA256

    d337d96e79a15ad6bbd56939ee16607a78a33b44158ae1437e8a5ca600e82b3c

  • SHA512

    cf1dc8147e117e8387a3fb1c4ab87ce8080291c7b19be0d87543bf119dd9d71436a0361f9710e191ab785760e7412281627738e01c9ae573accef2196f1ceb8d

  • SSDEEP

    6144:NeWM86RZzwTFQR9jD77fyO0XwBh12DD2JfCFFyinWLqcRJ:EWnE8FQvTfx0XwBz4D0aFjM

  Score

  10^/10

  emotetepoch5bankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2