Extracted

• • Target
    jaffacakes118_f0e1e6a836112a671d130cad67c1b787bc686f7fa45924c8d111ac1a4f7c7dcc.bin
  • Size 363KB
  • SHA256 f0e1e6a836112a671d130cad67c1b787bc686f7fa45924c8d111ac1a4f7c7dcc
  • MD5 9c4c4f65caf1636575e326ba0a25a949
  • SHA1 fe8462107e95fb1ddaeb43d17b7d9f2df5e06d4b
  • SHA512 bac668bb043e1817eb2f910cab1aeea22980c1ece41e78db07e78564399ff8e386001ba7313d9eb80c820cd691fcb982a7976d7f98ab017826aa8b3091063e95
  • SSDEEP 6144:rBCK1bmTTYYYYYAYYYYY5YYYYYrYYYYYsYYYYYfYYYYY8YYYYYuYYYYYWYYYYY04:rBCK1bmTZh
  • TLSH
    T19A844A203AFF6488B1B37F525BDCBBE98F5FFBB15616915E2540030B8A52E40CE65A31
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2