Extracted

• • Target

    ac48f4c7b48dd71e17c4a5c4701abc3a_JaffaCakes118

  • Size

    3.3MB

  • MD5

    ac48f4c7b48dd71e17c4a5c4701abc3a

  • SHA1

    83da8910b3f61a1c96dcac4abf920b71ea6b785c

  • SHA256

    97e699febb9f14fec1f29d9ea6c53a034ff18b3e742cee39fab64e5e378f3b9b

  • SHA512

    b5ad4c8fc3861c1e5660c67530ddcfdfda9a28cd41a448d9d2995f6dd0c192338bd59d42aaa0ca3a6575e82ab5abfb5365ff311b9efd3743ae4f5685cbb3ba96

  • SSDEEP

    98304:PGDCGpKOaunZsscpNUg8z7AYsCZpbTfVLasRRgcx:PYCGpB7niscsg+7AIJV1RRtx

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2