Extracted

• • Target

    23cf9be95112a70532fecf8ac281cfac_JaffaCakes118

  • Size

    363KB

  • MD5

    23cf9be95112a70532fecf8ac281cfac

  • SHA1

    ffefd12e4446b57e949da269849d3e41e48a1860

  • SHA256

    3b989a9a60b40ee5295f0d66bf9400fb75634c9cdc72325db17dc986321403aa

  • SHA512

    4ed5b544776e60f3c5bc13f0155b988db1832054fb7ccad1d03514402eb2431361a4deae0d04582e0d8e92fcda7c8d11c8402d59e92281f27c9a4bc3489ffed3

  • SSDEEP

    6144:nxjFSdDqxP1Ow5lKWyipxTKlYWofUVEPf3ZaYsKCwz1UCAdv1c8:FFSpsgw5sWyqAl8U+PfJb+6em8

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • An obfuscated cmd.exe command-line is typically used to evade detection.

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2