Extracted

• • Target

    ecfccd52eac33bcfcf7fb7d5917b1f60_JaffaCakes118

  • Size

    131KB

  • MD5

    ecfccd52eac33bcfcf7fb7d5917b1f60

  • SHA1

    fb334a3a9a26cb9e51fabab8b700a4e97610b0f0

  • SHA256

    2de89c748bd946f69be57df43e160b01b66833a43c88c37bd7b2aa67d2af5ff1

  • SHA512

    efcb452d50e7d0c6e5b9ff5660493ec578cea2d4195f4008161a4a87415a157cd393b7acfa4f5ba7f5f08606ed2825b24f97bc5969b8dcf05781965ceebc8d9c

  • SSDEEP

    1536:NZ0rgMc0qg4Kkd8j6IjM+ahy0H/ovL+b4GJog6unhEXPx04IsCs:Yrgzg4KkjoT2wvLuJyuMx0DsT

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral1behavioral2