Extracted

• • Target

    abaccab95426119757946c3fdf81d78a_JaffaCakes118

  • Size

    100KB

  • MD5

    abaccab95426119757946c3fdf81d78a

  • SHA1

    0ea5b3d605b5b5a1c445d54b7c48cebddbcb6c1b

  • SHA256

    497bbde060a8a9a13e3ec7d4ed1f440616a9f3930060be892810001df77fac7b

  • SHA512

    8b6f18dd7f2982c4bcaeef9ca473a8cfcb5b2e9c3ba351b8b801b348c08f3ab2d426a4d2e42c0b55f0e409e7d10dcbaeaf79a9405d58af5f23b70c945624265b

  • SSDEEP

    3072:7ja6CUdLxipO3t0jGCeXN6PusYx8ASq8ouv76m+:7AA1iw3t2ckPusA8A8lvD+

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2