Extracted

• • Target

    f24d37cbcc9a905355c0a138e503c973_JaffaCakes118

  • Size

    1.1MB

  • MD5

    f24d37cbcc9a905355c0a138e503c973

  • SHA1

    b591e5e2fdd63e69ffc84477759580890d3d7ca0

  • SHA256

    e4d087a8ec791924aa5721321491b27aa148878811be8ed1685342e2dd07f7d4

  • SHA512

    5eec80440036c2da47a4fd8f6756b29673f49f51072ba611fc0bd23b76f9b7809c3861aef4f981ddb025064d30008c4a696cb16869f4f5c826194def1b6e5dbf

  • SSDEEP

    12288:Hpb/ir7hhARq3/T4GHQSRvJ/ulYPCz+HavEwEQFrN:Ht/ir7bAK/ZFMlY8+HN9w

  Score

  10^/10

  metasploitbackdoordiscoveryevasionthemidatrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Drops file in System32 directory

  behavioral1behavioral2