Extracted

• • Target

    d3c6085b28f25ac024a16dd256e1e561_JaffaCakes118

  • Size

    159KB

  • MD5

    d3c6085b28f25ac024a16dd256e1e561

  • SHA1

    d557f1cf1f0009556aae3011dca73ea328807302

  • SHA256

    c14dfe8b841b975c5b40fd6482621b6c55f70803c4a13ce7fc8ea61c42697390

  • SHA512

    885579e92b9cd37b197b15cea94a55d31e3d7408131ee89ac4e373d98ed90254f41b5e240a0072f01ff87ad36141fdd243a53714b371db1be271a494c7f356f4

  • SSDEEP

    3072:NeXzTPtZqH+2afFlNliTSa4pSMVjXRibNyyS/vh:sHbzwWljgQx

  Score

  10^/10

  modiloadersalitybackdoordiscoveryevasiontrojanupx

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2