Extracted

• • Target

    3976ac236406fe3ec9369a49506bd056_JaffaCakes118

  • Size

    251KB

  • MD5

    3976ac236406fe3ec9369a49506bd056

  • SHA1

    501af2617959e5560d93d11f2d6439b8e5851198

  • SHA256

    e717503e0b005ae9e55f5b68598e20f54053a841547624052b42d44230114790

  • SHA512

    dacbc30dbccfae93f2ecdc467ee7f2e5dff51ce5d8b6725d79b169a251de1b2cb34a4af434746d276f7483016c45707f604bf6554a6fea449e85319a4e11dfdb

  • SSDEEP

    3072:6Yy0u8YGgjv+ZvchmkHcI/o1/Vb6///////////////////////////////////L:C0uXnWFchmmcI/o1/52y7Re

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Process spawned suspicious child process

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Drops file in System32 directory

  behavioral1behavioral2