Extracted

• • Target

    f0667325511596c7ec78f9e06898672a_JaffaCakes118

  • Size

    1.1MB

  • MD5

    f0667325511596c7ec78f9e06898672a

  • SHA1

    c3468b68c5fb3b3479477a919284039d5c9503ae

  • SHA256

    01e177f6ee5ffe6aa7f9dc4488286cb5994c93c46c36e75e61a6b834f7bb2306

  • SHA512

    25de5629ef534379bfd3d8394d3f1e8506a3f4e631d5997c4ea6d0f546069f1c04198747ffd9ca367737bd23e0b3ff0ae75a5f84d5159bc99924ba3ee55e74ad

  • SSDEEP

    12288:f/cdJ4raKxeQ9tEl9r5mZkxAjH7BWZSJy6FRotthxN:f/cH4zi9N8aAz7hRIPN

  Score

  10^/10

  metasploitbackdoordiscoveryevasionthemidatrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Drops file in System32 directory

  behavioral1behavioral2