Extracted

• • Target

    ef71c9c4670205398d4b7937f5f2498f_JaffaCakes118

  • Size

    257KB

  • MD5

    ef71c9c4670205398d4b7937f5f2498f

  • SHA1

    af6601b12fb96903dfbdfe9be30750fc7ac1116b

  • SHA256

    36787779630dbc9a8a62099387f9541b6cc98db05cc8c5ce10d41892cf39ae9a

  • SHA512

    35d8d4917171aad114a6c18e9a9c8d0d2bc4cd14d358d3ea0c1e6a7eac885eb39e5f7eef97a9c1ed2e32be1c430a5658a408fed4e295c9f825a477a9f088b793

  • SSDEEP

    6144:Ab+G4B1qBhWste4wmZ0nRvStn9pazG+JwHa5hb8x:Wy1SwstMy0RatbMG+Jw65ho

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2