Extracted

• • Target

    ee0b2933db4e04a116f876cb28ecc2cf_JaffaCakes118

  • Size

    153KB

  • MD5

    ee0b2933db4e04a116f876cb28ecc2cf

  • SHA1

    ee2df00d5a62f81b723e52e65322dc5e94a94342

  • SHA256

    47c8e3e92b05f289d4c090f3405365aa37f8e0d0bfce6535dc59d999117a2fda

  • SHA512

    eaa16b1ec4f019a3b9e252b62d9b7fb3fdd1b88761ebf2c40ce8ff2ddfe469a7efede5bdb81ae1c3a04710490c30ba596f08f2c3ccc021d04c8bb3f68476e271

  • SSDEEP

    1536:hAkT3yRFGEv0QtKPaOtMPAquK1gLadmpsHkkyeY+tB445TEgrO3jSWAg83tle1ZS:022TWTogk079THcpOu5UZ+DEuP

  Score

  10^/10

  discovery

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Process spawned suspicious child process

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Drops file in System32 directory

  behavioral1behavioral2