Extracted

• • Target

    86cf06c26cb4a454c9bd3e949c3f8859_JaffaCakes118

  • Size

    211KB

  • MD5

    86cf06c26cb4a454c9bd3e949c3f8859

  • SHA1

    bd27191acd3cc73c3d0adb5cabccd80cab1308e1

  • SHA256

    0e70180cb46404f2a4f520c107480376f285a146270dff8c35ad45647c7865f6

  • SHA512

    2655e668774c2666316fb621b88c396deca8e58cc3ebc06089425f375dbb3effe3b337318ac7866e2f757ae1db17845d06fc70af4334fbc15467e7a2f68039c6

  • SSDEEP

    6144:RxEzuLh6xp1scFN33leByAeBw4e2iHOx1cYY:XEzuLhiscrHhe+zY

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2