Extracted

• • Target

    Invoice_n_AAAA0000000_03-23.one

  • Size

    270KB

  • MD5

    6ec916a6a9162d09b9816ee90002483e

  • SHA1

    3d7e7e59d98ae1f044179bff8da666f45e1fd3fb

  • SHA256

    254406c0395784e3c070fb982dc6671f12009065de29385c9a0d4e32d01a2b89

  • SHA512

    65936bcd64ab23f7d540faad400b4bb2105ba7f2f4b9e6cf9301e61a6e07e5bcd17e32e889d3280c7a83572d60916227d4ddd5661a56784f6f99b2d1362b1468

  • SSDEEP

    3072:Q25h7OdS2cokRMkxS8qDAHJhorHBsNZqHqbuh7jGMkVh7Ufqjx3RFtDGY6Bbh7le:QH2Zf2gXm5ZGa3vRXm5ZGa3v7

  Score

  10^/10

  emotetepoch4bankertrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2