Extracted

• • Target

    8eab1a95a78485ae7f63c02eb4bb5812_JaffaCakes118

  • Size

    7.0MB

  • MD5

    8eab1a95a78485ae7f63c02eb4bb5812

  • SHA1

    62d854bd74d60878b23fe076154ae17b2f37933a

  • SHA256

    f56839ac3e072c29ec7458936700b82ae5454a195ed03df9965dc1abe80a3548

  • SHA512

    e0cc13402e540a47c567ae5259b64fd55d520f4bb477e570a30ecbc40903d89ac978d6409828db5f8003aab2b862f264c2ddead665cc0ffa9b8fb61ecea0b1d6

  • SSDEEP

    12288:12ghLvPhXpe3Pla7IntnNmmLJ3wbkyYN/fK:jXhZgPla7ItNFt3wbyN6

  Score

  10^/10

  spywarestealerupx

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2