Extracted

• • Target

    ef0adc381b8f91ba4d15f1974d1ad6d6_JaffaCakes118

  • Size

    509KB

  • MD5

    ef0adc381b8f91ba4d15f1974d1ad6d6

  • SHA1

    1788493893e381e7ce524bd1508ff17b832c3050

  • SHA256

    8a9cc40e3fe71fbb57dbb77c88b321a98ff1e8a9187214da6de1d88a22d3c6d5

  • SHA512

    310a7a628d0144b1eb957fe94aa483f5cb7f32be05b758c6bdd555a1de09587783b646fbeeba4ef40545a5403181c253fa2da3d5aa37f9f74f9d6d4e65ba01da

  • SSDEEP

    6144:+5SkUafGDETiAT/KZUxZ0nnHCu9q0ubDWHACSlDJ:FoOAv/sUuni6ADWHEdJ

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2