Extracted

• • Target

    38a081e3a3c30afe98da847545b85c25_JaffaCakes118

  • Size

    375KB

  • MD5

    38a081e3a3c30afe98da847545b85c25

  • SHA1

    445ef50c91475fffd8130db61a20dc60641c5754

  • SHA256

    3a9eb9047595ee4bce4168e9191ab2ba48b9e75b6c5e4a33a5f96e045b21216c

  • SHA512

    2403da5ad356da30be165acd92ca93776309c1927d9ef6dbdb57236e8925eee00367545527f22b45e87d66fb739ecd31bc47b6683be5d89a3c894949975c53f1

  • SSDEEP

    6144:3dvuKYNGOmhnqgu6FiidUogu6FXAb0qwR6l3T6N++CPy9QKoE54T6V:ktOqgu6F7Uogu6FX+C23ON++CPyboE51

  Score

  10^/10

  salitybackdoorevasionspywarestealertrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2