Extracted

• • Target

    e5d9a0ae25a4267911f8a7bcf650597e_JaffaCakes118

  • Size

    88KB

  • MD5

    e5d9a0ae25a4267911f8a7bcf650597e

  • SHA1

    f613ab292e797e2f246af2c0d18bb0420285983a

  • SHA256

    9d3037b0d335e62d630b1e9696af9bbf56cfdc58b9245792daaf3a236a7c13e8

  • SHA512

    8f11d30fc9e20446f02652a0ad24d3d46c1bfaf7afa0dbed716b1b4f25369c1bda81dd4daaa42b11f1ac7a284db04434f60d62ee853711919bd2ebcbcb340d87

  • SSDEEP

    1536:9Mq8Qgj5JBhyd+O3R7CLosPiSui3ZCEqNTk97TscicRoZO24gavHE4KV19o9ms7A:G9y0O30CO0EaTk973RoZOnl/n+eV8

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2