Extracted

• • Target

    3d7634a57671a2cb7c21f514374d28280fc3708f114ab73e0593ac911111e882.rtf

  • Size

    88KB

  • MD5

    ce3b08f58d579862f5b03bb1f563f9f9

  • SHA1

    aa9339e51447b2766306991a1b7c489b483da9ea

  • SHA256

    3d7634a57671a2cb7c21f514374d28280fc3708f114ab73e0593ac911111e882

  • SHA512

    327fac685fcd6d53aa7ac2ec854f3b4b7f8f2b7f47632948a931a098ea19607d3dfe58d36dc35024b8da468c82eedb855a2619328b82b81a7835ee72b1197308

  • SSDEEP

    384:qLP65auBFk7eeq/Gd0zCx8sqnNji/BucU+1vYEAWOqGYzY8FT52UXc0Wr:suHbeq/40zCx8s8tip6cYBrYzBFFPc0I

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2