Extracted

• • Target

    a2221498582330202580cb43e4f23be3_JaffaCakes118

  • Size

    273KB

  • MD5

    a2221498582330202580cb43e4f23be3

  • SHA1

    8f6362634a31dc04ba67e1902e284251d761334b

  • SHA256

    7f31c9cd43f003db06ab0aaace5e43cfc574fb3c3103b3dd8d33b0020e54fcda

  • SHA512

    3cbd99ac3f08884347ce2ac3cb87375b46775ab386296c7f49dfdcd3064cc091f1e4d2307400bd4ad75e9ee322e0ca5b6b95d5b39d6401d0c060bfb1f91c1455

  • SSDEEP

    6144:D6pnD+Dvi6HiME1oL/0MBUTyjT9MdqhYIaZ:unD+DveMbYj4cIaZ

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2