Extracted

• • Target
    jaffacakes118_4a549500046baad72152ec11819dab9f26510b9fe9fb7290e561d6f79864954f.bin
  • Size 185KB
  • SHA256 4a549500046baad72152ec11819dab9f26510b9fe9fb7290e561d6f79864954f
  • MD5 d30f9567ea4e632f5b8067a6d1f3835d
  • SHA1 4065b7705aa4adcbf503b190848d487c9267b386
  • SHA512 a0eacc4a0c187463373de2316b247130dadd6fd39a28edb7dd69e5d2d1b46cdce64b24f22bf9d011f127818fe96436c3a3f47246bd2bcc7200758a729fdd1c61
  • SSDEEP 768:/kdIF11111lo2rVPCVIXxNnxkkdvDdWqCENi11111611111w4i4pL/h11111811x:U2CV2NnBd7dYEa4i4FFrF29xw9vCf
  • TLSH
    T18604471026FF949CB2B37E670BF9BA954E5BFBB10639A19D26144306DB72E80CD90731
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2