Extracted

• • Target

    44444e992f378fe4fcaceff04098a56b_JaffaCakes118

  • Size

    261KB

  • MD5

    44444e992f378fe4fcaceff04098a56b

  • SHA1

    4e5a1293c8760776e194f239dbe3b08ab98da598

  • SHA256

    becd6cb7f8e35cb5795ffb77ed6121748853d732210c9f38501b20461d6b0d99

  • SHA512

    e384eaaf01400be1e92aaeca7458b528a367155cf39e3abf3e53007bd8e18c817a3e5f79fdfda97bb9eda2d4dda7ff39a3835e26a7e51016077ef2651426d4f6

  • SSDEEP

    6144:lb+G4B1qBhWste4wmZ0nRvStn9pazG+JwHa5hb8x:1y1SwstMy0RatbMG+Jw65ho

  Score

  10^/10

  metasploitbackdoortrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2