Extracted

• • Target

    e856b83bbe48cb575c17c32075685c22_JaffaCakes118

  • Size

    194KB

  • MD5

    e856b83bbe48cb575c17c32075685c22

  • SHA1

    7d0685256b7bd44171d3320ca6aea90d3929d111

  • SHA256

    4655873e3b6e1fb03d845c4c9df30dd0e71c5678c8ca8f58c6682a02cdc96491

  • SHA512

    c6653c4f4838ff5fc8acf0a5b28e76ad4072f8f9a1863c4a41a8a730993fb4942813cc2ab8016fe0a8d353d92921329b99934238a1ba4ad5573f2adb98bc10bb

  • SSDEEP

    6144:6sworcqbcxfRNFCEgCtgstX3BFxn2IqxXB:71oqYRAlCtp2D

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2