Extracted

• • Target

    e74cf8b213939d0ec3f8e0d12ce520db_JaffaCakes118

  • Size

    201KB

  • MD5

    e74cf8b213939d0ec3f8e0d12ce520db

  • SHA1

    86ed6f1a642a75b59950b135ace978d3ee3e4d19

  • SHA256

    a5fd0060f9f3208764e4e28f9cb9c4a4ef633b7fcf7ac64435457a1f947fc879

  • SHA512

    859ae7c8abd904ecfb14d245cfebdc33449a4008b0f44066130e68b7190d70d6f388cad13c3ed1a829c5eac4948b54868f3f90f0ae6cdc75f74df4e99462885f

  • SSDEEP

    6144:IACEbG3DdjjiLBpVZgy8XFSS7X23JcNs7ToV:IEkKVOyo0S7Xq2s7cV

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2