Extracted

• • Target

    e4658e0e2726e3df9e57d0803f81131a_JaffaCakes118

  • Size

    170KB

  • MD5

    e4658e0e2726e3df9e57d0803f81131a

  • SHA1

    2010f7a6959a79f6f62fc3b9d60a2fbfaa319576

  • SHA256

    32f27b469d6dff3ac95afd75128099dca7ff571e8ba6da207f6b66c5c72a20d5

  • SHA512

    36f1940cbf82f4562126cc903c17e0d4335cfb5da31f1266654c4cb72d7b6391343c5675415af7ec0680879d542aeef001bfdf75dd41bc8cf3227678d85fce5f

  • SSDEEP

    3072:D2xg58AduDN+pg9Qpw0NAYgU8a329Bxq6Gasm5+7g:XWAw0Vj8aOBTLsf7g

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2