Extracted

• • Target

    ea779117ee025bc63f722fba0da9fe56_JaffaCakes118

  • Size

    71KB

  • MD5

    ea779117ee025bc63f722fba0da9fe56

  • SHA1

    8314c4b4a911cf9a680c45fbaf8f98bd042a5c88

  • SHA256

    13cbc6196cfe79f109e75cdec73bfc75b0439081b0df50ca70a449dc77fcc7f8

  • SHA512

    547fbdf94522d52e19ed8340d6a2c0dbb845824c8976067c63f20793edacef9cc9a6aa7be9c166e79737c25a6acc892dad74e40ceeb0cf2209d49d1125e50d69

  • SSDEEP

    768:8pJcaUitGAlmrJpmxlzC+w99NBD+1ona4iXY4j8NrcBYbhn8N:8ptJlmrJpmxlRw99NBD+an2c8

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • An obfuscated cmd.exe command-line is typically used to evade detection.

  behavioral1behavioral2