Extracted

• • Target

    e92ffc748e8c4b86644da767a10502f7_JaffaCakes118

  • Size

    227KB

  • MD5

    e92ffc748e8c4b86644da767a10502f7

  • SHA1

    c0d241e597935e1e6a40899662aa66780ee25036

  • SHA256

    fc4b80c367768793ec67199e0497ed568d8ba97dc30ea661349695aae60ff3aa

  • SHA512

    f10273f7492ae4c5b044d8cb925463e40135272725f97962655f70744221e7f1b08ff97b46c9bcebf811047acd3a37acce36dacd85230a1a29eeafe1dee608af

  • SSDEEP

    6144:ynLtNO2QZGmZyU39j1joP2lT7BjrLS9ms40m44Htz6veWD:ynRNO2iGmB39j1kIT7Bmcs4O4AvdD

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2