Extracted

• • Target

    56a6c0261a72db745ea0f21a3c55c675.rtf

  • Size

    232KB

  • MD5

    56a6c0261a72db745ea0f21a3c55c675

  • SHA1

    3a7b8465d5256b4b9c6d50fc0452a641ab4abe09

  • SHA256

    ea87f3d339f1503e2544d94168480a3085ea9cf379bf8e397a7c08ecebdaaa8b

  • SHA512

    e3021a2ed4dd981cf09c16d29418632abfa640a2159afba260c340e554d62a95e353786050aafeb39493fdbe75ef565f812c9f082221260e12ead4742e6860f7

  • SSDEEP

    3072:qizWhCvLXkOT1PLdNQDjYNMwJwsilLiV0QnCan9uMd4+4gQ:qYdkKajYNMwJ8lLiV0QnBr4+4gQ

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2