Extracted

• • Target

    e0b85383d31efbacabbec98cd482f0a0_JaffaCakes118

  • Size

    142KB

  • MD5

    e0b85383d31efbacabbec98cd482f0a0

  • SHA1

    ae84ccb8a38e1bcf409b0fb23327ec9b28fb9479

  • SHA256

    b2ee4ecb1670894afa8edb69d932d7861cc2eae3fbd8914559e236d18ad50a78

  • SHA512

    9949fdc461ade092e13283a21b0274f2babe3822530d66c68a74432896ccbcc30c7a6b0707aca8678d5cc8d2b29165324aa485f1000eb8524b9d9ed9157debe5

  • SSDEEP

    1536:IBpHfa3BkRD3bNqfNpu39IId5a6XP3Mg8afmqSMxXOYgnJnIJe4SGOMKaK4/r:0R1qf69xak3MgxmRY0nae4sMKT6r

  Score

  10^/10

  discovery

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Drops file in System32 directory

  behavioral1behavioral2