Extracted

• • Target

    edfbd3ed00c16f0b88e016ef67a1c954_JaffaCakes118

  • Size

    599KB

  • MD5

    edfbd3ed00c16f0b88e016ef67a1c954

  • SHA1

    445161c71b0fb30f56650e0a9572b28c3af1e259

  • SHA256

    540ff7bfb7db15e5486ac9c93d7c05624973f73982f8b661f7eb99c40f8f4f82

  • SHA512

    6edcf28632161c02c8d6f2fde7fdb8376f5ac0a9e8011cdb9475290bab275604a3613524137bb6f94097b04e0aff2c1269f5705a75114f48318716d2866fc791

  • SSDEEP

    12288:X/82OHgu0FYGTdU0pFQdQPi5ucr+p4SBz0jTcrGUZ4CYs0cLZK:FuUYGxU6gQaIcr+X0j4SZCYV

  Score

  10^/10

  discoverypersistenceupx

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2