Extracted

• • Target

    8f76e86093d71f34c2e6f824984034185964f3d15c28df1b61adf5165fbb212e.rtf

  • Size

    67KB

  • MD5

    c9ac55d64a51738b57f065449c7e3911

  • SHA1

    7b9dd5b4e76e99d711b0fe11582e6ff06d9ca830

  • SHA256

    8f76e86093d71f34c2e6f824984034185964f3d15c28df1b61adf5165fbb212e

  • SHA512

    6d78c5a5cfc7fa34942e87ceae41d6e97debaa9469831ffbc4482c9fc1b531a171b1a12fe6ff3902b8919aee94bdf619cd0b43daba07166d9e47042a9eaf8e60

  • SSDEEP

    768:ZD+xsejlud5HY1ayCyu7OHAzlzjRYEX4Bo:ZGjE3qy7OglR9XWo

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2