Extracted

• • Target

    dcebfaf520933a514ef6e91147f028f8_JaffaCakes118

  • Size

    84KB

  • MD5

    dcebfaf520933a514ef6e91147f028f8

  • SHA1

    0efe99901cbfa89a576ae7aab294eb837a7e15c9

  • SHA256

    75b621993635ffbd74e1f56f40f0eb37c24063ac53c31d5408840faedd1d9db7

  • SHA512

    8c2845c1955459f13f851ca5125a38b33a97be7376079cabad2c79ff7a2f9918df728368070d87fc39652354205d7a0a7682c9adf7aa1d03781346611f75a0e2

  • SSDEEP

    1536:BWy9QKp+VNJ1Px91aav/McKQCUwljFf+NDHj:BW8pAV1fv/McKjtl+j

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2