Extracted

• • Target

    246028ae0e22c724e927e01c1d0384e7_JaffaCakes118

  • Size

    5.2MB

  • MD5

    246028ae0e22c724e927e01c1d0384e7

  • SHA1

    e09ae5161eabb11c98ea9fd230d8abe8a40bcc59

  • SHA256

    50dd82e2fabb02351808242e4ec97b905dff3f435ab78ab03d1c551190c2d227

  • SHA512

    d25f0b069e6c34def5d588e37ff8e0df9debe8be60fd20a49cb683867fe946482574e687997a2ae2ca3d9248e01fde50d20e60b9daa34e868eda43ec7935cae9

  • SSDEEP

    98304:Q51jhEVZjBPNuAvwOH0BLMjF6m6VUgNjTJSBvI6JQ/uLc8OckRbiV9q:+1N2lXDH0B+YmaUgNj9QIxp8zZVE

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2