Extracted

• • Target

    37d4422865376af0b834de8c84464c97_JaffaCakes118

  • Size

    368KB

  • MD5

    37d4422865376af0b834de8c84464c97

  • SHA1

    7414384dd6540fffe6121acbf1eb25ee588737a9

  • SHA256

    77a7fd14cca43cd430eba421128aef5c9b1d7d04f1484f6702df324444c4441f

  • SHA512

    94dcf77bb0e33842c629a37f07aaf01802cd1d11fc5f9394853b1771a116aec765f521ff446fe330d648b34d51537c4bd48ba12b18721f90e6ebe3fdb685abf5

  • SSDEEP

    6144:t1dlZlo5yhD68wOIO1MuZ6uBKW4Y5BwuyrfzHU1jqWvh28jEj8:t1dlno5yhD68wTONdR5BcrfKjqwhtt

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2