Extracted

• • Target

    ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118

  • Size

    939KB

  • MD5

    ef706e60b202ee7d320f0cd9cbdec1b9

  • SHA1

    64a34f5e436ae0df2c476c8239072f4333eaac69

  • SHA256

    0867aae175ae9035b4e452386923c8b6e2ceefe8fd37b850f2b5a88e91a71f1d

  • SHA512

    2725dbabaa5a4b8da258da17bea6c7bde7950591026cf6058551235214c635fba430d1fac4534da237117064c882f5e635c3c611223c2efa1df52641c2bad101

  • SSDEEP

    12288:LtsyVG0Yco+gunQUBCEAWfykqVNeN24epxozOJhaXL3F2Soypj:La+G7ZunQU1aVNeN2joz8hEL3cSJp

  Score

  10^/10

  discoveryspywarestealerupx

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2