Extracted

• • Target

    df231f3dc9b26bc2833154a727605d91_JaffaCakes118

  • Size

    149KB

  • MD5

    df231f3dc9b26bc2833154a727605d91

  • SHA1

    bafd9bbf0fa223b501708f273176f6c6d519bb36

  • SHA256

    d923f46b1c0d0660ddc0bb3354ecfb548661def894d185d753571d23af0911fa

  • SHA512

    ca1ca3701a8b09a3e6e6e767cc68cad20df6677afa37253a5cf47f3a863678456fc863668d14e5b24a573d30ec0ea9929ecae753539f9c05a393a8fdcddd9c58

  • SSDEEP

    3072:1Yknf95/09PD69ajp6hZIt947R7gQV8D2RToWHfV4kuBnaj2KNgc:j95M974uCItmN7lV8aRToWHfkaj2KNX

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2