Extracted

• • Target

    County Contract - 2023-03-22_1308 Proforce.one

  • Size

    261KB

  • MD5

    b219da295bd653c9e1ee4923e8956399

  • SHA1

    abee832277ae9973bf16a69bf760ba71a595039c

  • SHA256

    5979681f3ce4373ee44d319cd50ff3d8b5f54df4c5aa805bac0cfcdba40df200

  • SHA512

    b5841d87441a8a37e46e3f71ea8b2b49cc2aa43ede349e23bc2756625a3a66607c23391f986f5872ddf1ba692b2e4be509fe3bcae80cdf5df3c40b8f7b391be5

  • SSDEEP

    3072:xXzeHrBwsHzUfxJ3mY2IsGllOb3HPWaBtOzUfxJ3mY2IsGllOb3HPWaBtuXO:FeHrBwsYXm5ZGa3vRXm5ZGa3vb

  Score

  10^/10

  emotetepoch4bankertrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2