Extracted

• • Target

    d9cd4cd2fcfb641b66cac9b5da8d2253_JaffaCakes118

  • Size

    509KB

  • MD5

    d9cd4cd2fcfb641b66cac9b5da8d2253

  • SHA1

    acf9bd23a3757f608142df8cd5b3afd31b103455

  • SHA256

    815fc296b63822300ab0a63999a61d10b5dc7aff48d577f29086cbc9fec1dc8f

  • SHA512

    53ae270c05cb7a15d5e78e7d655395cdea0c43308334aef9ac4d7466293f249b31f5489fc09b2f5abb513ddc37d0ca1dcd304cc77667aa7eecd1300df280e6d4

  • SSDEEP

    6144:fX96kBHAS267CRsYYVdN7abzQlMolk5S78+VnfBk:f3tASIsjN7e4aG8qpk

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2