Extracted

• • Target

    f28616ac03b042b344330102e4e4201a_JaffaCakes118

  • Size

    270KB

  • MD5

    f28616ac03b042b344330102e4e4201a

  • SHA1

    d37d3429c45b2afcd9ddc6f9778dc55aac9b9000

  • SHA256

    29b32c79861dd0cbcf1c4d919870c3cfab01ef55c8b39ee963f2682b6c24a344

  • SHA512

    b14ea1990dd30ec293e591a9e98297b5d256ea2d646d6da76f1e2c3e7b30cb22598fbb6720543da3b5d9a0ea8bcc2581d847e91bb2ab1457d7cb236755261f56

  • SSDEEP

    6144:FlOTtH1MW2TUfWfVT108CqMRtTm8q6ruIg36PjIv/01Xoq:f6qTUfWfodqM7TLq6yhKPS/MXo

  Score

  10^/10

  metasploitbackdoordiscoverytrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2