Extracted

• • Target

    ea42d6237a907449597f5e51b11550bf_JaffaCakes118

  • Size

    484KB

  • MD5

    ea42d6237a907449597f5e51b11550bf

  • SHA1

    b54f1e4c8c2f926eb99ea331a90f4a725ed6b9c1

  • SHA256

    691ec8d5e811ec5470b929dd73a8401de746ad8455848bc8825ea1453e2074c8

  • SHA512

    1c1a5f8c05939829cf060c1daa9de10572b11f2615b623c1c063f814a0667a54e0d53b43fce6547d9d0809d5d02018b8507d20ae9d36c2b56e2e3ce11d2def22

  • SSDEEP

    12288:BRaunlwVJqgNH/8SV98timhJGu9RKo284bo2N:BR8VJqKkSpmNuoEboO

  Score

  10^/10

  metasploitbackdoordefense_evasiondiscoverythemidatrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2