Extracted

• • Target

    d680da31a1d9479010533fb244582623_JaffaCakes118

  • Size

    92KB

  • MD5

    d680da31a1d9479010533fb244582623

  • SHA1

    25278f79275dda4ff7fe0b08c3ef35596bf53897

  • SHA256

    418fb7539a099e2e1ae2c864f811ac6963d435e41df009ee0ecb7d7ab3bfdd56

  • SHA512

    ff264c2defdfaa7b3648730027e352c6c488179526b153dca1de34c52174c15411922902fb34aa9a3b67cefde19f0f745a039acf2304f74755cf67822e1b184f

  • SSDEEP

    1536:GSquE20GQupe67eYsnNSOGtE/0Vd3+fSUudhMzd2cFr3t78ChgYi3k5ve23zOd:Za6SYsn8t4ixlHdhMzwcJl8lDQe23zOd

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2