Extracted

• • Target

    0aa381312ab7553cb4a603e8e57c8582_JaffaCakes118

  • Size

    199KB

  • MD5

    0aa381312ab7553cb4a603e8e57c8582

  • SHA1

    f9f69404ebdf590ce11aec99a45bc07caabd654d

  • SHA256

    1baca6df5405b1382432d42c2e064da832f47d748a7e69ce461a438d1e9eeb76

  • SHA512

    34980179d8fc789b38b2ad8a05fc16b95869d2e80847be83751a735e4a5d5e6b51adac52455366a54e3a554271f7ab378ed518a13b6da3deb0ea2977abcf404d

  • SSDEEP

    1536:PGGGGGGGGGG2xJLEt+LaaGGGGGGGGGGjLo9xilpfsdKY7xST/Ephkop8cEpTWj1i:xrfrzOH98ipgaEDvxBYae

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Process spawned suspicious child process

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Drops file in System32 directory

  behavioral1behavioral2