Extracted

• • Target

    SPE930231839KJ.doc

  • Size

    284KB

  • MD5

    1ed1a8d46dc3e3d89fdbf5eb00f42edb

  • SHA1

    1b6e2c9ba31d58d4e330874314e59a7fce33dad5

  • SHA256

    d7e01bffc54e99f8ead1a8499dae9d51fa259a4f18062f2d5312cd3ee09394ad

  • SHA512

    817af8445436c2325e8d2c5047b66149d776dca834f4b1fb584e938f287791cd0545c59430dbd927c3a88c23ec0c06f10f2272085a1c1913ac1a4a05af0287d2

  • SSDEEP

    3072:2IdQGckpM56QDp+SBTA8ku4afD4Ka1Rvl/4Wbqzwc7vanLubTvjVwKVi3yJuq6r:x9HkpzTTfD4KuNbqzryKvmKV8yJor

  Score

  10^/10

  emotetepoch4bankerpersistencetrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2