Extracted

• • Target

    e57c6b04b7cbdcfbff6fd0ac4b33c995_JaffaCakes118

  • Size

    347KB

  • MD5

    e57c6b04b7cbdcfbff6fd0ac4b33c995

  • SHA1

    e935b210d4caa388b5005c1a871ed3182a7e250a

  • SHA256

    12f59a3cdbe40ca6dbae4de01e40bf0f59f0477c273884a0656600eddcb3e866

  • SHA512

    f61d3b29612945a0a7001611259456d98e1d99c544805046347ab1cd485ba7bdc0f0d4169bae3d81012e606ab322e6d47a1629a0d6774e6777b6cba5a6436d05

  • SSDEEP

    6144:U2xQWBTEVv+9z/OhHd0FqQSoW8+ZcQcaAirxDR0qoL:fQaei4HQSjrxK1

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2