Extracted

• • Target

    e1c1be841dea078501a6db6dae165aa3_JaffaCakes118

  • Size

    476KB

  • MD5

    e1c1be841dea078501a6db6dae165aa3

  • SHA1

    77787af28b073a9525a932e2373aa7626b0701f2

  • SHA256

    8351236b506a460e2b3ee2abebbde4cbf6dc648ff739a5c7c804c9b42745da9c

  • SHA512

    57c8ad059a00e8189b6418cd991edc8bb2e8a3c0298d7cef72b6cd6b9f5b667bf3d1378db62c40f223edfc157ae726b64928e9763ef17e40d6b339bd7cc4720a

  • SSDEEP

    12288:aeJg3Stp4Bn+laUoW/6cOce8uhroZPXPQK:jJg3SYd+laUdOce8uV6QK

  Score

  10^/10

  metasploitbackdoordefense_evasiondiscoverythemidatrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2