Extracted

• • Target

    4696bbaf700747fe9c04cda67421e2b4_JaffaCakes118

  • Size

    212KB

  • MD5

    4696bbaf700747fe9c04cda67421e2b4

  • SHA1

    4963575b92a086b29d6fd0da02ae478deff2daf4

  • SHA256

    9b7e938cd2f33e52e58eb1e83333160ff04a62adb3e10810842f7a870ec49793

  • SHA512

    cbe46f1b7a2bc3b6480c148d931ca529bc9cc7676db85bfb8217f95b717cdb164dde758e38cb9c1c992ab02df52abd2ce35bd1bc56301e919fd888a3e52d37db

  • SSDEEP

    6144:0CNNUkeSHbdunO2JC9YCLAzwvP6bQ7yMP+DE827dZ:fleS7xBGU16b7MP+Dd27

  Score

  10^/10

  metasploitbackdoorbootkitevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Looks for VMWare Tools registry key

    evasion

  • Deletes itself

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2