Extracted

• • Target
    14b4924873f6d423b61af3323b9a1636_JaffaCakes118
  • Size 368KB
  • SHA256 9c63603befe22355c1a32460abf30a4ca9c3074ad3d8a0e0d55ae673eee1c56d
  • MD5 14b4924873f6d423b61af3323b9a1636
  • SHA1 529461267f1b59d2b8decde33a11da00f0a46aed
  • SHA512 ad104c41de22c9117b6b3b8c22d1e2226cdab6fc5e9d0587f4494fc0b369651f6837488ef2b2214c3813d0f92a7afe32be9c4cbce829c67f9ec21aef9f307386
  • SSDEEP 6144:KD04PlLlVnPyFFbdMOU1yK383NyHUTcj/bfbc5A:KD7lPnP4pXU1yKm40TcHbc2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2