Extracted

• • Target
    jaffacakes118_903e28bd1314d9190509e682e4f646eceb7c4b57b549ffff5ba15c9a888c4979.bin
  • Size 177KB
  • SHA256 903e28bd1314d9190509e682e4f646eceb7c4b57b549ffff5ba15c9a888c4979
  • MD5 a32b1ecc7fc8c489e23976d324d5c4aa
  • SHA1 40208ac331bf4ac95db4703d7dcdb93b0b8cd191
  • SHA512 acab215a0adffef1f54068c86cc51183ae53b332818f5ae0248f16b9644a47294422977431dc88836096c2049b1ee4201b199a5528d4afaedc21089fd02b0a64
  • SSDEEP 1536:ISsbjjQz8IXA64yE81eGHHXsVxjZKVGqI:Ivvck81eGHHXsVJ
  • TLSH
    T1F60448603AFFA06CB2637E674BF9BAD44E5BFBA15639505D3540430A8B63E40CE61B31
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2