Extracted

• • Target

    a4a04913ae5aa608c39f2923a5792482_JaffaCakes118

  • Size

    161KB

  • MD5

    a4a04913ae5aa608c39f2923a5792482

  • SHA1

    f1390825995875c93f7ae67f2bec175a13953909

  • SHA256

    21625230474a55191ff09f7f29eaf0cff26e1fcfc6680a91885dda9ddad6129e

  • SHA512

    dc725f9660b954ce5826c73c158f90ae33e75d33a8410e3bdfd0010dc4ef1913bde2cdcbb457a362debff0325e50751ca53cf737cb7bc150cb3f18692d3c4bdc

  • SSDEEP

    1536:VxYAcBPFEiUSQH/P7HgOdPTQlmncksPsrbfPchzb8JRD3bNqfNpu39IId5a6XP3a:PR1qf69xak3MgxCl/ZIb0X+RrMgo

  Score

  10^/10

  discovery

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Process spawned suspicious child process

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Drops file in System32 directory

  behavioral1behavioral2