Extracted

• • Target

    de2727d13e7f40cc89df6f76873ae5eb_JaffaCakes118

  • Size

    140KB

  • MD5

    de2727d13e7f40cc89df6f76873ae5eb

  • SHA1

    7793c43511b337787e46226b8ab742470082e640

  • SHA256

    8147046c842df9bc9ac5bd88726dde13111b14137806dc6e3256bc10ed90bcd7

  • SHA512

    96ed692915650ed377f5a5afcbc9f411b34c9337f4e5354592a5e9c219a8ae487645f922ef2b405dcb588a5fbf0af58f0da7bf1aba4074f2364c0dc149e60f36

  • SSDEEP

    3072:3WEd1WlwiHzjIToNykjt10BuW5X9+PxeD7bxudz0SOtgNnchV2ewZx3:GY+nIOxjt10sWl4XdzdagNnewewZt

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2