Extracted

• • Target

    emotet_64.doc

  • Size

    180KB

  • MD5

    69b50cf495f52ceb5e3cbc26be0df1cb

  • SHA1

    3b3b8b489588b1ed21202e6f8fff3d15abbdd37a

  • SHA256

    74bac23bf452becf85cb38ee649a6c16dfa9f495455c2b5b873c47f0d71dbfd8

  • SHA512

    4c98c73ae91c396693d9594c1dc38afdddfc255ad4f7a07e9b5a00f4712575d4dcce141bc5efc9b5c0e172710449590c572d7bd34d47ea608b1d3f1a435cb54d

  • SSDEEP

    3072:C5083hrYbbYZD2zGT9nVBZRcQPh1gbrqy2o+AbfBcbD37fVbe8:CdhsbbYZD2KTFVBZ2Qqrqy26dwD37

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • An obfuscated cmd.exe command-line is typically used to evade detection.

  behavioral1behavioral2