Extracted

• • Target

    d04c3e9fb4ae5d3a4167ff06bbc66596_JaffaCakes118

  • Size

    655KB

  • MD5

    d04c3e9fb4ae5d3a4167ff06bbc66596

  • SHA1

    954561aa1478c659651badb305ab2e80ace25a23

  • SHA256

    a513c2b146487524ce45573f893bc84c86f0f3586ae01f41f41e477904892761

  • SHA512

    70601224f003fa1b9116b4a5c6d78925c6097697ae66b8370010907c09a6035d3ad0b43fb6aad5a6e4440892b1ab6ed2c960383239eecc9863d8e4176a9eb5f8

  • SSDEEP

    12288:quFfqwstdjccEf+AFWDsvRMveyGhDNaTQj2EQwXUf7iJKeXhs7FPXD8zp4u/lE4o:zktBwkDsIiDNGEUEKeXh2Z4vI

  Score

  10^/10

  discoverypersistenceupx

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2