Extracted

• • Target

    e5fc4f4884756dea6a5990455c10dc97_JaffaCakes118

  • Size

    228KB

  • MD5

    e5fc4f4884756dea6a5990455c10dc97

  • SHA1

    01a3992b7b3cf1ba2ef617521a4d86e8d53a459a

  • SHA256

    1075fd44284327b02b368a5884938b5b26b1f51e21d27f46dba21c729286be78

  • SHA512

    12e0ad475603e7edc90e7fabf37861235801329ee4d491009dddc52f98e531f688f7bf07112434473499f6e4090ff3a1ffc4c555cf5e89662e6e49ec67ca741f

  • SSDEEP

    6144:ugckIrFLd4zL/5ZqY5WrOk52tAiH/gA2uqpc:ugckULdWjPqY5Wr7SbH/gANqm

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2