Extracted

• • Target

    f06be3b64c821532398808707c021706_JaffaCakes118

  • Size

    199KB

  • MD5

    f06be3b64c821532398808707c021706

  • SHA1

    0c98a1d3bb270a93ddbd881f184201f54ec88e5b

  • SHA256

    a2a3de0abe80a878339ece99f1a2d60f47010c8123aa038d1f0337c9e99ab092

  • SHA512

    7d66b326cc1f665dcfb46ac68240d0470b62abec4e7da921c48093c62f0219a67bc42c0eab5c65335fe6cecca1acafd3cd84359b0664e953405ccdc105b5260f

  • SSDEEP

    6144:iexr1w8DvTfxBqUiTljE8EaX0KAQY2g6:ie3bJyj37Y2g6

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2