2018-09-04 - QUICK POST: HANCITOR MALSPAM USES PDF ATTACHMENT

ASSOCIATED FILES:

NOTES:


Shown above:  Chain of events for today's Hancitor malspam infection.

 

IMAGES


Shown above:  Screenshot of an email from today's wave of Hancitor malspam.

 


Shown above:  PDF attachment from the malspam.

 


Shown above:  After downloading the Word doc, enable macros to infect a vulnerable Windows host.

 


Shown above:  Traffic from the infection filtered in Wireshark.

 

Click here to return to the main page.