Extracted

• • Target
    6430.doc
  • Size 110KB
  • SHA256 3385d8b70b15636eb098d80c55943e026954d800eea56cccca9674c12d03fe6a
  • MD5 e64bbb34758b86da97054805029270e2
  • SHA1 dc1c3c2534d162fae0dead444e143d00065f50bb
  • SHA512 1bc678f4b1d91d6145578c1be4b1fd8dac38df8cb25a8f2a5a48a29ca107533b72a38bc20c8ea40a29104733bfd22cf44d88bb830c0ebb12e54f7bf15b987856
  • SSDEEP 1536:nspPqGC7Xhx3UJJcoYzVKq6ahYB9f603CyKx:nspCXrUJCPzIq6ahY/60SyKx
  • TLSH
    T197B3B202B0A6FD2FDB9001780AABCFFD6365AC55AE12D50B3156F72D2C7DA94E7D0281
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  dropperexecutionvalyria

  • Family: Valyria

    Malicious Word document which is a loader for other malware.

    droppervalyria

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2