Extracted

• • Target

    484ca151445e3fb77e6a98d077d72d1f_JaffaCakes118

  • Size

    116KB

  • MD5

    484ca151445e3fb77e6a98d077d72d1f

  • SHA1

    396156a2935f2ea1a086a96021ba10ded4994cf5

  • SHA256

    861dc9f7425c54ca192825634cde246290aa7e77fb71c3e070fb37b16c56c99f

  • SHA512

    fd12fd738da27a7a454bed35a8e3c08820136c758f2cb2b5a8352d7630435e86a38bb7b2ac54d1e5427318adb4ee7c207112853cf73058cd23b68697ae8fcb43

  • SSDEEP

    3072:8Z65UAF8tWMv55UpxPggiLrJ88cdFMz4BJ/uK:8EtF835kxPggiLrKTdWzEWK

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2