1130_206410993.doc
Classification: Malicious
1130_206410993.doc is a malicious file sample. Linked to Hancitor malware. Reported by 1 threat source, last seen 2020-11-30.
Detection summary
- 54 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: HANCITOR (S0499)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic.Malware | Abuse.ch | 2020-11-30 17:39:44 | 2020-11-30 17:39:44 | malicious-activity | |
| Hancitor | Abuse.ch | 2020-11-30 17:39:44 | 2020-11-30 17:39:44 | malicious-activity | S0499 Hancitor |
Sample information
- Filenames
- 1130_206410993.doc
- File type
- application/msword
- MD5
28ab184b90b90e55e154e718eaf4cc1f- SHA-1
5bb65876198d309fe394bb9b313cca4403208478- SHA-256
687f7bba20b525b3e93a52ecf1d816e34521a476197616a6b1b2dd3a6c5990c3- First indexed
- 2020-11-30 19:15:04
- Last updated
- 2026-07-08 02:47:53
Antivirus detections
| Engine | Detection |
|---|---|
| Elastic | malicious (high confidence) |
| NANO-Antivirus | Trojan.Ole2.Vbs-heuristic.druvzi |
| Rising | Dropper.ExeInDoc!1.A504 (CLASSIC) |
| VIPRE | LooksLike.Macro.Malware.k (v) |
| TrendMicro | HEUR_VBA.O2 |
| McAfee-GW-Edition | BehavesLike.OLE2.Downloader.gg |
| SentinelOne | Static AI - Malicious OLE |
| GData | Macro.Trojan-Dropper.Krt.A |
| Microsoft | Trojan:Script/Oneeva.A!ml |
| McAfee | Artemis!865635D3B535 |
| TACHYON | Suspicious/W97.NS.Gen |
| ESET-NOD32 | a variant of VBA/TrojanDropper.Agent.BQY |
| Tencent | Heur.Macro.Generic.d.1feec255 |
| Ikarus | Win32.Outbreak |
| Qihoo-360 | virus.office.obfuscated.1 |
| ALYac | Trojan.Downloader.DOC.Gen |
| AVG | Win32:MalwareX-gen [Trj] |
| Acronis | suspicious |
| AhnLab-V3 | Dropper/MSOffice.Generic |
| Antiy-AVL | Trojan[APT]/Win32.TA511 |
| Arcabit | Trojan.Pack.Emotet.6 |
| Avast | Win32:MalwareX-gen [Trj] |
| Avira | TR/AD.ZDlder.BL |
| BitDefender | Gen:Heur.Pack.Emotet.6 |
| CAT-QuickHeal | W97M.Downloader.40105 |
| CTX | doc.trojan.generic |
| ClamAV | Doc.Dropper.Hancitor-9845854-0 |
| Cynet | Malicious (score: 99) |
| DrWeb | Exploit.Siggen3.3397 |
| Emsisoft | Gen:Heur.Pack.Emotet.6 (B) |
| F-Secure | Trojan.TR/AD.ZDlder.BL |
| Fortinet | VBA/Agent.BQY!tr |
| Highly Suspicious | |
| Ikarus | Trojan-Dropper.VBA.Agent |
| Kaspersky | Trojan.Win32.Agent.xafwah |
| Lionic | Trojan.MSWord.Hancitor.4!c |
| MicroWorld-eScan | Gen:Heur.Pack.Emotet.6 |
| Microsoft | TrojanDropper:O97M/Hancitor.AJ!MTB |
| NANO-Antivirus | Trojan.Win32.Chanitor.igokxg |
| Rising | Dropper.ExeInDoc/OFFICE!1.A504 (CLASSIC) |
| Skyhigh | BehavesLike.OLE2.Suspicious.gg |
| Sophos | Troj/DocDrp-ABB |
| Symantec | Trojan.Gen.2 |
| TrellixENS | W97M/Downloader.dis |
| TrendMicro | TROJ_FRS.0NA103L320 |
| TrendMicro-HouseCall | TROJ_FRS.0NA103L320 |
| VBA32 | TrojanDropper.O97M.Hancitor.AJ |
| VIPRE | Gen:Heur.Pack.Emotet.6 |
| Varist | W32/Agent.CCD.gen!Eldorado |
| VirIT | Office.VBA_Macro_Heur |
| Xcitium | Malware@#315p689gska9u |
| ZoneAlarm | Troj/DocDrp-ABB |
| alibabacloud | Trojan:MSOffice/Dropper.du |
| huorong | OMacro/Dropper.du |