Extracted

• • Target

    dee9b650a2715ca9d2cbf76e3c53fd10_JaffaCakes118

  • Size

    127KB

  • MD5

    dee9b650a2715ca9d2cbf76e3c53fd10

  • SHA1

    d36aeafddac0bf71d49bdf03cc85e5a6bd884f7c

  • SHA256

    2dc2eb8627895dc217347a868db15af9ebec3481fb4bdc97fc04f675449e5ec5

  • SHA512

    ae98d56cf1121fd26ad8a81a5155f3b8d137e69282b791547368f2d4d9f3c10ef68b451d850d3b8c027d6d72d946ec7fa2e98138880053a27e6eca583ecd5e84

  • SSDEEP

    3072:r/T5AaEXW9Gq9solEtau+TtyTePnIbo8rc5feVAq8QszhJk1:H5AKwqEauc1vI0iGLDW

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2