Extracted

• • Target

    d82bc76a2cea2d2db0b73a9f115d2b04_JaffaCakes118

  • Size

    131KB

  • MD5

    d82bc76a2cea2d2db0b73a9f115d2b04

  • SHA1

    84a6c0f4407506f0a3cede9677960c0903024ab9

  • SHA256

    6efc702100a2916a908d244f5f494ac4bc7cc39d80e0f5465d0a01f84c058c9d

  • SHA512

    5af98c8032b1b9072ae764c2710a7abc23bed7d60117a7402354b8b060ae7c2fbec677df8ab111b9ef4afb1be1dc48444baf6b54fc98b007bdeb851d150a6795

  • SSDEEP

    3072:pVtA1eMEZHjyTZPLXZyVkauOKFHypCplp:pVtYSDKjZk8ypCpr

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2