Extracted

• • Target

    0fefb64acfe9401308fbfeca1e1012d6_JaffaCakes118

  • Size

    485KB

  • MD5

    0fefb64acfe9401308fbfeca1e1012d6

  • SHA1

    006d0e07d98ff7b4bcd4d547f89d845bca5fc038

  • SHA256

    5f58d74a1180ba3ff03b45ed9569a50067e080218bce87bb7e58e86f75c9b470

  • SHA512

    5d6f47ba96c1521db4531baaf20761c8d51a60fa7206ae3ba5f9e3f3889765a5b45c434cbe0745e412fd78b81bd41b9ae5f27c18c911479951ae8e7ba6edf191

  • SSDEEP

    12288:mjkArEN249AyE/rbaMct4bO2/VB9MS8+wdiJ:xFE//Tct4bOshq+wdiJ

  Score

  10^/10

  upxsalitybackdoorevasiontrojan

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2