Extracted

• • Target

    031dd1f6da6b3feb8fddae2f9a3d9067_JaffaCakes118

  • Size

    155KB

  • MD5

    031dd1f6da6b3feb8fddae2f9a3d9067

  • SHA1

    686254b3a4fd8cdb801f1b8514e602bf3c73c839

  • SHA256

    201d656cf297eb3aa80bf39bf2242f1df635cce5732fda7eda145aa8b8d94668

  • SHA512

    3c195c4a9047d12ffb20a387043ffc18e6df7656d25ccd9f33cf11d2c6dfab31fc891ff2517d9dde4fa30ce7a7d65338d97b09cd1ca7bb593b3fc0758a9efde5

  • SSDEEP

    3072:gLk39fhYXJSmUrkx37lrjCPoUyIJXpT0jr3pwta9q2pXByjgx4lmILW:gQg5UrjByQxsr3Pq2NByjgx40ILW

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    00a0194c20ee912257df53bfe258ee4a

  • SHA1

    d7b4e319bc5119024690dc8230b9cc919b1b86b2

  • SHA256

    dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

  • SHA512

    3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

  • SSDEEP

    192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

  Score

  3^/10
  behavioral3behavioral4