Extracted

• • Target

    84288560bcb297ea77f35af1fd74df59_JaffaCakes118

  • Size

    199KB

  • MD5

    84288560bcb297ea77f35af1fd74df59

  • SHA1

    4d511236a7e83f46986b6a61febeebf4b4487679

  • SHA256

    79c92c2ebb525e262506063090767033c5f5abc3730976e0ea1f2a8722813681

  • SHA512

    4cac52dcc2bd8cc9cb7266dfbf7b33633a9408316b5a22e886fe0b5435c671fc614ca04c410e7966c3699b84e37dd6f924b9c458b74adf08db264ad2f8050770

  • SSDEEP

    6144:mQ6ZiWRd80thX1ef/t8VRHz8Mz9sze/+fnHaGg:mxiSdry2JzfaaGvg

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2