Extracted

• • Target
    JaffaCakes118_2cf234a33be54ffa5c49f4380e01fdac
  • Size 387KB
  • SHA256 111a2dc96e082b86a79dd90ec307c977a21c7aee0ddb141d688a17bd65f3661d
  • MD5 2cf234a33be54ffa5c49f4380e01fdac
  • SHA1 e7f83e5d90d318368b355b78f4d92c01f9b5def3
  • SHA512 02ccf1b583ddde4c51abfeaccc1d2fbc741ba826e9f9d6127f64b1df3c50ed3760992fa21812ad7a9cb9cd1b222d0e943753de5a8b412a3a093dc5cef08405e8
  • SSDEEP 12288:dGjGYCf6pCXE9hbrD1b7PxYcuE0gXPByytSwG:YjGCkgBrXYcu3gXPQ2/G
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  1301_dsf7823discoverydownloaderhancitor

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Hancitor family

    hancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2