Extracted

• • Target
    jaffacakes118_f59caf2280fe26f4d178f8019d860e9ac610325264a0fc9710cc71c033aa8342.bin
  • Size 363KB
  • SHA256 f59caf2280fe26f4d178f8019d860e9ac610325264a0fc9710cc71c033aa8342
  • MD5 aa68b26c8b95b78d7912ea7cb2f118d9
  • SHA1 da469b9d0cf382a53c451feb39b169e3ce95b76a
  • SHA512 21e67d1db535efa053ef2ce6b9f20b067211502d1bf1d1cc182773200c6d3b844156278c7417b852ceea6f5efc62a0d857b1b40f3825e077f442336f963d523e
  • SSDEEP 6144:9NZO09090909090F09090909090c09090909090+09090909090Z09090909090u:9NZHCCCCCqCCCCCdCCCCCXCCCCCOCCCu
  • TLSH
    T1CF84AD2035EF944CB1737F631BDCB7E94E6BF7B1262AA1992500430B9B62E44CD96B31
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2