Extracted

• • Target

    1850cdc7ab0916f9fd881be094209075_JaffaCakes118

  • Size

    176KB

  • MD5

    1850cdc7ab0916f9fd881be094209075

  • SHA1

    5f1236e5e9f1bd238e0ae515370eaee77c46dff6

  • SHA256

    5dcc1f23c9a32892f18643fffe7bfcc7f68b75773311b8ae7a12b920152be48b

  • SHA512

    ccfa9f0c49a2524fe3759d34f55667c9526d4deebf8eab0635605496ba7c390d96bc506b5d3fa4b5dfc66b1382910116383463f8a1bc8d28aef4399806ec1bc2

  • SSDEEP

    3072:WfkVD1BSqao9c3HwsanTdgyOxsP+f+7jV0xZtSyo7Ng1TTFAgJQs/:W4Sqjc3HsTaxoqMGkm1TTyhs/

  Score

  10^/10

  ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2