Extracted

• • Target

    3eba91b1b5863c70212f54cbec5ac1ee_JaffaCakes118

  • Size

    170KB

  • MD5

    3eba91b1b5863c70212f54cbec5ac1ee

  • SHA1

    9ecaa499f91a14ab2b4179d775126ce14f318a15

  • SHA256

    e1662738f330bfebfdea0cf3b2e65a6d60dc7ba570737f75091cb71a547b20e8

  • SHA512

    af1ecf4530042e5756bef2b96d135402c0a739f9fb7708889cc9ebb907f027aa814a7b7dc7ba1b02288745eb65f2116ee97b373c9ebc02b4c046e16f78128a6f

  • SSDEEP

    3072:KxjnB29gb8onSGxrPVwk5I5Pc4BG1z6/vhAnPMf:Kxy6a5Pc4BGsvhAP8

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • An obfuscated cmd.exe command-line is typically used to evade detection.

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2