Extracted

• • Target

    de3a90a394a420a8ac2c63bc62ebbfe8_JaffaCakes118

  • Size

    85KB

  • MD5

    de3a90a394a420a8ac2c63bc62ebbfe8

  • SHA1

    dd33014257e5107826db9632f484ccea311d47b5

  • SHA256

    5fb518fa8ae74ca7e70018d0f0b209a13074c64620b06b3779056bf873cd2fae

  • SHA512

    235c77736c6d19145ed58883e65c4c762691252aa49b3f42418491eae7723f7abd97f6727cefc8c9f610a38c6efb3a04aefb70aa2010e86a063b8539b14b30ce

  • SSDEEP

    768:k2yB4OEKjmW9/MqtBMENPOgHvgn+1o95KMD0xz99j8ZFsi6dlnZa5jmhFw/9Vg6C:Lu7ljmW9/bvFM+a95KMD03I6/unhBY

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • An obfuscated cmd.exe command-line is typically used to evade detection.

  behavioral1behavioral2