Extracted

• • Target

    e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118

  • Size

    1.2MB

  • MD5

    e5b44088941e2fe5ec8f8e160d7c5f11

  • SHA1

    d8dc8fb855eaaa35e6c4bd84fdb8ac42450ee2d7

  • SHA256

    235ca0544fcf3f022b2939f2b3c0f81aee82e888b9d764ab8d22fe1ed0f13248

  • SHA512

    0eac3fc40fe0055348aab7ea1d3ec39ebf051786acda53f1f3feeda73eafc2999d8428ee83ed7ae892240d6f65e57e583df63c45783104f37a41ca4561d4d435

  • SSDEEP

    24576:/Mz40YtokrysuW6xWAnij/m/zjFFtjxJDjTX7eQ5AlKO8eb47IqM6r:kE0YtokrXYnij/mLdjxJvvL5Alx8eb43

  Score

  10^/10

  metasploitbackdoordiscoveryevasionthemidatrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies security service

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Drops file in System32 directory

  behavioral1behavioral2