Extracted

• • Target

    d0390e21783e2d60e3a5298bbf3528d2_JaffaCakes118

  • Size

    1.4MB

  • MD5

    d0390e21783e2d60e3a5298bbf3528d2

  • SHA1

    5c02c3c704e7323a68bc6c0938956b6612dc21ea

  • SHA256

    20f90b1f80b4482238e08a24767df0c3dc879b6601c80435aca92134b98c9318

  • SHA512

    b7debb5d19b0a87a353ec143cef976103be424a7135ed6dc83e09090dfc7ca5d9428efb3496bfc4820edbee44cf748088f2496b95ea4386d418b1e57bca0a5e4

  • SSDEEP

    24576:Wc7hVZ/Xg67peL1SmsigA3F2GzEhWxee6QR21WoT8Jo97j07PssADXC6dhxpF36e:D79Xg6QSw33whWxFg1zCoFjyWh9IWZ

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2