Extracted

• • Target

    73d85bca598fe0f63426ad390306ea4a_JaffaCakes118

  • Size

    179KB

  • MD5

    73d85bca598fe0f63426ad390306ea4a

  • SHA1

    ac91ce91ad79f62b749739dc202962d5bf63a48d

  • SHA256

    8116e0ec558a71b144d6212ee1d386b79b9160668257180f288b1b979b494059

  • SHA512

    a0184d37d9e5c3f687c9f8acb0983c51247c6300ac7a2c7f41e93ef4d84fd3476796fe1ec45f27256cd23ecce3c0220e64d7bcbec957924b380f518d0df7a51d

  • SSDEEP

    1536:uasrbYasrb2rdi1Ir77zOH98Wj2gpng9+a9hSGIRK9b/WYjd2LO6h/QC27TgvY:crfrzOH98ipgpSGYK9TngLOm27TgvY

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Process spawned suspicious child process

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Drops file in System32 directory

  behavioral1behavioral2