Extracted

• • Target

    d3c9a3f008f7baa648f199b454a1d911_JaffaCakes118

  • Size

    197KB

  • MD5

    d3c9a3f008f7baa648f199b454a1d911

  • SHA1

    e2f695dd13157152b5ab08edd698772f3108cc32

  • SHA256

    aec1af68303837564c031516d4e3dd1c40362ae841b28b5310d4b50037eb6b8f

  • SHA512

    daa12ad39345d241531fa8af7038d3be242e88ffe7f8a7a25dbca21824a079e215e28fa091347823a2c6a75c76f5d1b80d06ab8c7577bafc541e046888d0a47a

  • SSDEEP

    6144:V7HO9ROelVNatlXbaGFcIQbToNITtTP8CeQnjtqi7FaZxK2:IPOOaPjNI5TP8LSjaj3

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2