Extracted

• • Target

    08fb53f614027e9c5c2a6d65f49f1fb4_JaffaCakes118

  • Size

    242KB

  • MD5

    08fb53f614027e9c5c2a6d65f49f1fb4

  • SHA1

    bb39da62e9faa97bdd3b5c4810d0e027b294c672

  • SHA256

    5693960848ba147821389b3aadece7efa70aa2e1cf020fa4994f0861bd344d4a

  • SHA512

    2e563a3dbdbe4042320c8b308c1bf5825b4d35d27cd47d34a4c6ea81efa853e1f71a5dfdaccab6e79a38520ad6e22ab29341e869f8c75fc175f32fd38d8428cf

  • SSDEEP

    3072:wYy0u8YGgjv+ZvchmkHcI/o1/Vb6///////////////////////////////////S:40uXnWFchmmcI/o1/mOfbD

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Process spawned suspicious child process

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Drops file in System32 directory

  behavioral1behavioral2