Extracted

• • Target

    dac457cb8775f455a69f11939164be28_JaffaCakes118

  • Size

    2.0MB

  • MD5

    dac457cb8775f455a69f11939164be28

  • SHA1

    374c4a8f7b6bfbb80cd763e9be1db63ab0f49b1e

  • SHA256

    fdfef78e52a05f5fe29e6a367635326b7277fdf860e86e6eef3e6528f072f7a0

  • SHA512

    2f34296449ceecd5cb65b0e31210051b12dce304a11b52ab9042f77bb897001429203ae4e14726d0281f4894576b0f634a2e51d07d863b2ed023ff51fa5dccf7

  • SSDEEP

    49152:AtKOx+dANKmCvKQPJtcdGgIpsR26ug+Wr19i:AF+vKIJoG56Rzvi

  Score

  10^/10

  discoveryupxdefense_evasionpersistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2