Extracted

• • Target

    0bcf359b5b52b4e5f58da3d1bfec0078_JaffaCakes118

  • Size

    196KB

  • MD5

    0bcf359b5b52b4e5f58da3d1bfec0078

  • SHA1

    f3fc3fab2b0b246501485b7240658f047e4891af

  • SHA256

    ff32a8a02659ab6f0367dcb35ae34888d060767e0e490bf574d68087f001e16a

  • SHA512

    53b7e05ffdc0c733c0066a423fa8a25e8a0361200b8ac447808143aceb0a004031b47e3e3646b2e88f7adeb2ac9ed08f0f30a2555eb77b2081ab7182a3ed9e2c

  • SSDEEP

    3072:3C2BNz4k2a+RvXp5ApGbpV4kHs2vhcN6TneY+uxZX91JVOZcjY:xFvNce5SZXDwz

  Score

  10^/10

  salitybackdoorevasionpersistenceprivilege_escalationtrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2