Extracted

• • Target

    6a885f1127b1712832596031309146b7_JaffaCakes118

  • Size

    1.8MB

  • MD5

    6a885f1127b1712832596031309146b7

  • SHA1

    5389f14f859ce56fe6001a8cafd902d86d62d188

  • SHA256

    5d2e4ef960679144d2d4b085ddefc452432c8294a589b855d638b6bbca5ef75f

  • SHA512

    f3d454071a902198ba2c93ec6405fbaf6d4ac41be0936559467d8632f228f2650d68d00832a0c1c28daa542349fa41222fd5fdd6c3b7ed6d73f7228491b9e93b

  • SSDEEP

    49152:naNu1g19Kjb9No+4wTb0FJlKORHKcpbhIvl:naz1RHbKORqcul

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2