Extracted

• • Target

    dd194d73ec917904b0afe2821aa01c85_JaffaCakes118

  • Size

    286KB

  • MD5

    dd194d73ec917904b0afe2821aa01c85

  • SHA1

    94b0db53bb7c43c19388bb2889765e6ac0350866

  • SHA256

    34e0323224b797591731c6d8a5684050b20fec86aed946f61e25d42b5d4ae2e1

  • SHA512

    daa49a6fe1ce9c91e8d38c67ed0b6d72faf83c3670dd092c4b1e78d160cb0d97fb03f6a958e7da0348d54380d4ca6eccf73dc345966bf0eebaaca45853511734

  • SSDEEP

    6144:zYEawDqulHdFcU8P9kaYac9/aKwNbB/o9t7EtoXuVBe:zrawDNlHdWDqaKwNbS9tQ

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2