Extracted

• • Target

    bf431a57b9c1e56e7161451e6722ebaa_JaffaCakes118

  • Size

    108KB

  • MD5

    bf431a57b9c1e56e7161451e6722ebaa

  • SHA1

    531fb464e9c0b1009686f64038f3e82bce7a92fa

  • SHA256

    c925a08142e38938c60d7cd2c0183749fe979707224b7a1fd1d164514e97245b

  • SHA512

    41bf5f4ad9b6d7cddc2158bf33e411f737c8c4bf25b9622cf4bf209dc7c0f3658150c4e8913f11e888e151e5576ddb78f1364262c654a1a66504eb7f7aed3cd7

  • SSDEEP

    3072:01+MJKrUnFYY5z1i0Nmbi5fJBNL/Jjoout:kIrPj0NmWtNNjooS

  Score

  10^/10

  latentbotmodiloaderdiscoveryevasiontrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • UAC bypass

    evasiontrojan

  • ModiLoader Second Stage

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2