Extracted

• • Target

    ef1468580814f6552c19be6b02ba2b32_JaffaCakes118

  • Size

    197KB

  • MD5

    ef1468580814f6552c19be6b02ba2b32

  • SHA1

    66c3f835fbe68e8ab1f6b8c729c903db48c8b792

  • SHA256

    68be06f4942d31a2271bdfd2a47f60fb8d02e137dffb8c37707377d173908d65

  • SHA512

    b3bbe454d7804b4e8608daa2e99b76e2581d97e8f4c8501005a348c0e2b9303914816863530428fe30c75de7bf51750904e14a28e946a87e35e5552cc7e64ba2

  • SSDEEP

    6144:uzIrfiLhOUkIyYSQLVK+7Qvf/oe6jWm6OED+/:u0rfiL8UkI9K+7CoJym6Z+/

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2