Extracted

• • Target

    e9bd66c8df9cdcb8690146cd59c74f6c_JaffaCakes118

  • Size

    84KB

  • MD5

    e9bd66c8df9cdcb8690146cd59c74f6c

  • SHA1

    10cb2be5c94ede12115d7c2e2ee82c523185b00d

  • SHA256

    49f2c1872bdc6bf4524f87016ee0e7f9a5b23e75dee49c2638c08c37236605c8

  • SHA512

    878be14d2433e698073aba39e98546e397b0bc3278fb4335bdb6bb550ec839a5cac51a4efa59376c43d0fc4f48aa1b55630a9b27251258447e5bf2539f093774

  • SSDEEP

    1536:u4EQphu7av/vZ91jv/97UyX5EQCUwljFf+NDHA:u6ruWv/71pwyX5Ejtl+A

  Score

  10^/10

  metasploitbackdoordiscoverypersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2