Extracted

• • Target

    e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118

  • Size

    199KB

  • MD5

    e9e901e051f43ae7c83fee5b52122ab1

  • SHA1

    b22b7f00d518cbe3dd67ebb3cbd2cfa1bba50594

  • SHA256

    e9c83989dbb6401dd387267f388c63d2ade2dade618a36272cd7d6ec8223bc93

  • SHA512

    08362dcf1b2a6daa927b86f3def058470520bcc910891145d43572bb72b7aa852f1a2c988596831d8f1a967378e2044fc32af4392c4ab5be4430d7f080d39eaf

  • SSDEEP

    6144:nOymp9JYg+X3Nozpd8dUj3N7+tX+7JXmC58V:nYudCz38dkN7+tXAJXr58V

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2