Extracted

• • Target

    d7ebd59097031d80fdaafdfa958a9d53_JaffaCakes118

  • Size

    93KB

  • MD5

    d7ebd59097031d80fdaafdfa958a9d53

  • SHA1

    ecbaf3d0a423f43d095605cd2b4913f063d5193f

  • SHA256

    e88322c9466f0e3fb4ab3824b512ea7c8d25a41a838acff44055f5f5571f1727

  • SHA512

    c4664e81f097d0d776bf498ef039f9c52cbbc4418bad66cdff0831fbe4466381464c9c99913094710eb642c8860d0dcf45a816781fec866d01bbb3e4959d392d

  • SSDEEP

    1536:ySquE20GQVzUfsvJ3XaNvsb06jsR4Ic/gKJEENUwQmI5xgrQDeUgrk/kYE+G0rhN:1sUYAvsb06ja4jgPgAjdHPrKe3coN

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2