Extracted

Extracted

• • Target

    e1a65e469e3639df3444f75cd580b592_JaffaCakes118

  • Size

    143KB

  • MD5

    e1a65e469e3639df3444f75cd580b592

  • SHA1

    86cc19b318b17aab6be79cd9c291cdc1a801e2c0

  • SHA256

    2d0e32a5d9622977437e712f79f89a15bb347faf953959ca2b897119c67f1b72

  • SHA512

    18ebedfca7fd3ec75d1cc90d09fd7c7400ada4f886120772940d27dfba1b5e16eb5c0dd6d14f743752756e167adc900d4bd5afa6d34d19ac17b7ee8d7536b772

  • SSDEEP

    3072:ihLDT2Bv83MEJo6VB5EMc9k2FNx42+R/EhoITsB:+Y8cooaBi9i2FNx42+1Pq

  Score

  10^/10

  metasploitbackdoordiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2