Extracted

• • Target

    a07b3a149c12324566b4c3f3550a0a6b_JaffaCakes118

  • Size

    160KB

  • MD5

    a07b3a149c12324566b4c3f3550a0a6b

  • SHA1

    8db1e594cf90de2fd371977333661bef968c0a6e

  • SHA256

    115d1ed6f823c370e1b33dfa97569b4c77dd8e1021f3e62f54ca9860da3d0033

  • SHA512

    2e3014ba8aeb942aa3cefa01962105958f14726db7270e2c5e2f06d3e6bcaf76e608b346422267053e369bfac86ebe6bde522be6cf69f5d9684042dc1bd3fb84

  • SSDEEP

    1536:TB445TEgrO3jSWAg83tle1ZZ0293QM0eetR2cOupLB5UZ5F+a9bPzlnb3nSp:T22TWTogk079THcpOu5UZRP5b3nSp

  Score

  10^/10

  discovery

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Drops file in System32 directory

  behavioral1behavioral2