Extracted

• • Target

    JaffaCakes118_06f1cd7b07c7b6e68d13b9a2ab891fbc

  • Size

    173KB

  • MD5

    06f1cd7b07c7b6e68d13b9a2ab891fbc

  • SHA1

    f7b4b8be3a86d0e93f6bb35ced507dd032556722

  • SHA256

    908db1a1a1782ad566ed5e71adade16d6f3d976df9e5481a602ddb4d7ad53557

  • SHA512

    90ae55a6fa0ed876f0abb3fb13c73a8d193f48a2b011e6e70910c66145eb350bdc95f469c8a7799402c82f6bf004bd079090bd1a85711430ba4691bfd0068f7c

  • SSDEEP

    3072:YwT4OUNzBgQEPcnc2kTdcrrXyQBsc0vWJVi4IrwVOYbdYPeFmfG5/+vGsPt4kohf:YwT4OUNzBgQEPcnc2tPIIIw

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral1behavioral2