Extracted

• • Target
    강지현.docx
  • Size 536KB
  • SHA256 453fff853ae047ddf5bcf8b1bbe08ec6e81a4a43b42757873e7e5dbfd05e9e11
  • MD5 0bb0ae135c2f4ec39e93dcf66027604d
  • SHA1 a6820376bdd3272b073dcb4239eaf83e1dc17242
  • SHA512 07e749b4e68acebc77f2009e8e482c0587f83c6bf537ced32650bdae93fe8b08ef7aebf03b39a5ad8fc8f10a2b96fe8a0af3c8e36e20808f12387cccefb3b69d
  • SSDEEP 12288:g5kKDM9krgIGM8jU/h8FagHiF/DPR1VqOEW07:SkYMi1GHKFrI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  danabotbankertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Abuses OpenXML format to download file from external location

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2