Extracted

• • Target

    b1b1b46182236ad1ca363773c4a601df_JaffaCakes118

  • Size

    558KB

  • MD5

    b1b1b46182236ad1ca363773c4a601df

  • SHA1

    4563f3a7790e988c825796dfa0f3e1ec4ddb2d70

  • SHA256

    1e06ef556ce681f14ed8fe9cfd3ebba0dfd2ec97602cfa39b99bec9a7437ed1a

  • SHA512

    2f3f04cdb4c32f26ff86b09cb350934036f317413b0a494e4059af6d659719e8a129264a8c47bbcdfd88eb77060fb1030cca9d5f52f4f05c62e12ebfab99ed9f

  • SSDEEP

    12288:zoy+ZLkjL3SzugvrnGPAMgpvsey0m9owzM:PE/u4GPnwv5y0m9oOM

  Score

  10^/10

  buerexecutionloaderupx

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2