Extracted

• • Target

    ddc967f0053b83ac5c0bbb8a19634f3a_JaffaCakes118

  • Size

    266KB

  • MD5

    ddc967f0053b83ac5c0bbb8a19634f3a

  • SHA1

    8a096341793625a7496fee507915e914da956ebb

  • SHA256

    c9d839e7d59cdc4adefa73a88d0027267c9d1ca5b41e156cc64e5115be7cf8c7

  • SHA512

    766c9efd6471c8ea05e56c0dace685323c10e1344b7a7dd26efcbb93f066df38e1a533ff9b88bfc8cf33385f6253c4d2c8f3233cfd32536f9d2727668204de82

  • SSDEEP

    3072:SkhgqkhgACSQKaSx+SbtYqS4fvS7GQRbSVuz1QzC9klhxztsZ5QPw45xUB5BECCc:SCwQK3RpVS7G4SVuz1QzLhxztsZGPwT

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2