Extracted

• • Target

    711ae558d7286ad13644149159044dcc_JaffaCakes118

  • Size

    408KB

  • MD5

    711ae558d7286ad13644149159044dcc

  • SHA1

    57810350fb7267b2870d8d4bdabfedf9710ca7e0

  • SHA256

    eab1b6c30aad7cd1f0ffa2f5214f4f616c07276d18e917bed2f70b36a100864e

  • SHA512

    37cc209630974a9005e4e49d2eb96170bcc935a2612d7d0a65fe99aed1870660fb855255bbde6a78c2f2064e4a5ad352f222fb570259362bf02faf8989ea655f

  • SSDEEP

    6144:k+bELf/Mi/cWdi5pV/JNWOVhMtWk8mW4e5/K74cDtN3e:OdOpNX1hxmuyN3e

  Score

  10^/10

  discoverysalitybackdoorevasionpersistencetrojanupx

  • Modifies visibility of file extensions in Explorer

    evasion

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2