Extracted

• • Target

    ea40a8812fe134d016e69821d683894e_JaffaCakes118

  • Size

    213KB

  • MD5

    ea40a8812fe134d016e69821d683894e

  • SHA1

    9de98e619bdeaaba0afd40d6edaf705345e955c3

  • SHA256

    0e05a7b223afcc64878c6810222b1c9df924be1484681eff9cdb81677c56a8ab

  • SHA512

    00f85d0d6a1e69fd26113ed976781f0c4e1a4dc76c5391bd82c197fe1ad82271ddcd17551aacc5a30fd4c2324cc43bf7a62689063b4643d68e1209d4007a4c3b

  • SSDEEP

    3072:oZDeZcvudycLy/307B64bA3EihhQOm1kXMPok8Vv4SGWjc2v5eGVcmYEy7udNLNL:1dZoeO3Ekokcoj+ZK7vo8qgX+5DN6gK

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2