Extracted

• • Target

    7cdf83d6e63668847d8087b3e99423dd_JaffaCakes118

  • Size

    190KB

  • MD5

    7cdf83d6e63668847d8087b3e99423dd

  • SHA1

    58805a5bd7c36ddde5b43b5fe48e84eff75949d7

  • SHA256

    3a6190dc0c4581f2459ecdeeafb619930f0e261f2f6eb7b80cb4fe2a18cce058

  • SHA512

    8c2012425d549d6c3ddb7fa88c40a75ae2eb1ffe196c9a640c9000b0e32944168f4b3505028e9c583ab9758212e047a5fa582a49e7606e34024f8c8901a6b058

  • SSDEEP

    3072:i9ufstRUUKSns8T00JSHUgteMJ8qMD7gjV0zKNf9cfmfE7qdmVJKk/Juvc5a8a8B:i9ufsfgIf0pLWKbW

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Process spawned suspicious child process

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Drops file in System32 directory

  behavioral1behavioral2