Extracted

• • Target

    e840933f5451d3b557822435cf742afd_JaffaCakes118

  • Size

    203KB

  • MD5

    e840933f5451d3b557822435cf742afd

  • SHA1

    b62b589b6e6dbda10192985bc8461f032a736a90

  • SHA256

    d94d5010a0f5290177119634aff748451c649f7445bb9202cee25dff4eae70c4

  • SHA512

    a7df5360557d9d52fb1cfef310ea05237e435b8843d3c066c992b2efa96f2bfda83bb40face5a6f58cbf9c64fe3b3d4c7d1e04422e56b9d39ada7a19ca0a4e5c

  • SSDEEP

    6144:du8ecqFlZ2l2UZHTNZ35bXNjN9lYs6oCBcS0hHLad:d1ecqgcUZHHJjJvfkcDHY

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2