Extracted

• • Target

    eab8c7a7e519791f21fb10bfd8a42886_JaffaCakes118

  • Size

    272KB

  • MD5

    eab8c7a7e519791f21fb10bfd8a42886

  • SHA1

    b6829dae24b63140ab957e99bce52b0d8d99f9fb

  • SHA256

    104bc48bd0a442e15f8752a5586720b5fb3bfadf2952639236d2ad24fcc5911e

  • SHA512

    1112592719342620d1cb9d6aa3ce155a53bd44c2096587de4d269d2988a8da5a24b8c21731eb820f63014e1247efe35c418974c4c774f34da6f0e111f71fc3ba

  • SSDEEP

    6144:D6pnD+Dvi6HiME1oL/0MBUTyjT9MdqhYIK:unD+DveMbYj4cIK

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2