Extracted

• • Target

    39d1bfb7a77144fa40f249b7eb98882a_JaffaCakes118

  • Size

    167KB

  • MD5

    39d1bfb7a77144fa40f249b7eb98882a

  • SHA1

    33a9408c8d764947b4463126837a1df36164e735

  • SHA256

    ed0bbe83bd741fdd3fabd8a29777c9e9cab25b6b6c9659deb6ab94a8b27e4410

  • SHA512

    47ceac2ba48062983d0afff97fe968e120f8c5d82e5837ca635370370d515b9a5608ad8e87b2494fcff7cc79dcd059827b5c7d970bf36adb067f2315f9702028

  • SSDEEP

    3072:DYNQKPWDyKRefVJltZrpRl1P3iuWezso0Cj1Pcq43Hr:cNSDyKRO1thpIeI121k37

  Score

  10^/10

  salitybackdoorevasionpersistenceprivilege_escalationtrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2