Extracted

• • Target

    b8eee470bd22ad85a34870892bdafba7_JaffaCakes118

  • Size

    608KB

  • MD5

    b8eee470bd22ad85a34870892bdafba7

  • SHA1

    5ac377dab4c37f69b796c12f7dc752a8d97b264b

  • SHA256

    7938d27dfdce4fb1bcd000aa99da2a3933f6c1066ffb00044bb2b063abd71955

  • SHA512

    23c35648e0cdedf7a4d8d81fca110a89705547d96270f2eaed4270f8196fda43df0b9a98eec06516f3bc333b2c7ad29cfa1e3814f81c467c3b93196d4f022d59

  • SSDEEP

    12288:9HGWEue59s/agO8NnFM6Uf8fehqoBU6COEtHP8uE3YS/od1Y7QoS0y90:QZueDUagpN68Sn5COEZ8u3S/o2y

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2