Extracted

• • Target

    dd4f7c11093ec643eb87a79ce886567b_JaffaCakes118

  • Size

    156KB

  • MD5

    dd4f7c11093ec643eb87a79ce886567b

  • SHA1

    cb3110f9f7aff09689cbb4aae2cf1ab723df9794

  • SHA256

    9b99ae32bd51d49aca7926b9002545c408008acba23db0467142c2a7f9336617

  • SHA512

    173dde39f9c0b9519b2b0404e0ab51669ae793edc4fe0ad9ea394e53f64341dd7186a02cbbf10f71964447dd52b93641dbec3d1baa28d984c571b218659de10e

  • SSDEEP

    3072:HxjnB29gb8onwJ1vxkZy8f/xiHm8VAzy3X7:HxydJbkZy8Xym8VAzy3X

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2