Extracted

• • Target
    BOOKING_CONFIRMATION.js
  • Size 1.0MB
  • SHA256 8754cc9b00034cb36d0e8de01d1ebc0cfceef3ef85b5fb3b3175a9e278bfde8a
  • MD5 cbf1b1c9b64f2124dcee75453a4e3ed7
  • SHA1 16d09092a86705121fde0c8349bc48c72c7666fe
  • SHA512 f2ec91b63ea1e20af3b1339f485a5939b321b3b139a88c08c86d967a34913ed5d281ec13c54edf93975e06b9f09a1b31ae977b32a406958cc0b8a56f6bdbdcf9
  • SSDEEP 768:pjZS37L6qvOll8XllS4qlcumlliyjEWhbHO3Yz8w/HlD4kCKS4Vg7l0tlhtYpxZl:+4
  • TLSH
    T1B6352BFA36F9F8BC4A1B31C6D9878406DB31350AC817BD54F2BCB0D3548251A68E9D7A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2