Extracted

• • Target

    c918f47fda0745fedaca86195397ace0_JaffaCakes118

  • Size

    248KB

  • MD5

    c918f47fda0745fedaca86195397ace0

  • SHA1

    90367cd9c7d83d6028e0125123541a138c5a82d6

  • SHA256

    7af935b7cd7ddc1383ca817ba41f0784340459331754fcdfa4348fc2a2fe7813

  • SHA512

    894663307c2bc59f31ac3fd5ae6934971dd8b7beebbbcb18de5d020ad43309baf8a1012662c33b195dc1bd3bfcaae45a87e5b5ef396cb58d0e56f0956fb781ac

  • SSDEEP

    3072:BO4ZAi7XnrA+Tj7/tKXYAO+aqjL/xSu90OoiLuDKZXfwKeljR17:BOCA83rA+Tj7lKYMa4xUOmD+XfwLH

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • An obfuscated cmd.exe command-line is typically used to evade detection.

  behavioral1behavioral2