Extracted

• • Target

    eda4c598bb3a3a5f0d36eac37eb714ac_JaffaCakes118

  • Size

    502KB

  • MD5

    eda4c598bb3a3a5f0d36eac37eb714ac

  • SHA1

    6ee96d598f365462fda6c38769994102e181dccf

  • SHA256

    c1c0c50edd88174efd7670e02691d710278b922add87e22496a62fa88e90ff4f

  • SHA512

    2cfbbdf9c06c24b82fe92ddbf93b445bcb42178c98bd781a9e359ee1bfbce493e3502ecf93059b72fbb7f7e5735e3852963b9a2e295b902454afe0f87e712ae9

  • SSDEEP

    12288:BckDZLHaX4v8iGVWv7Arpa8ReUnxNaEAkC/a2gH3HTeDrC:iiZLHNgcUrUSn2iMa2Xe

  Score

  10^/10

  discoverypersistenceupx

  • Modifies WinLogon for persistence

    persistence

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2