Extracted

• • Target

    f13868ececfbb8b8b653eee6b2b61fc7_JaffaCakes118

  • Size

    373KB

  • MD5

    f13868ececfbb8b8b653eee6b2b61fc7

  • SHA1

    45632264e33c856c5300c921c5a5b46075512ee7

  • SHA256

    c6dc200b86ebc07a353f7208aef05e6a27597a1b8ee3be57e8c534f6fc6971da

  • SHA512

    da8d9094f7a81d231387337e8375b4ce53909fb7ad9305b1626d1bbdf1c88db68d47412b7062bbb4e75aa242f547a6d1472943b117c1adf77e0ed41d4f04ce41

  • SSDEEP

    6144:u070v1sfejKs5NOrD6gWH4/qQDvXY9Imf8+sx/rF2frcwZFyHVPAsWltmXhBp7vm:u0hmNOrD9Wy4Imf8+erScYF181enWxC

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2