Extracted

• • Target

    f388f802b87d84061945eb9d5ebf5801_JaffaCakes118

  • Size

    192KB

  • MD5

    f388f802b87d84061945eb9d5ebf5801

  • SHA1

    ae22d0a698846adcbcc9dd6bc7464224a8369cdb

  • SHA256

    065bc3788baebb5b8d05de36a49ce29bf2509b2ac00100677bc461c9feeb3a1e

  • SHA512

    37bccf5b7973d117571a47e949e92a8a11abd33ef5932d73af5f4e81d42032826320dd49012e9105eae1560aa6cf033d4c6b95da56f54b53f775bc7b0420cbc4

  • SSDEEP

    3072:7EUTV4r6dQYxvbtdtfJIct2KKgHqvs248O6mOw50DrYRky/6lRnWE:4GjtdlVKgHA748+Ow5XRF/6lRWE

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2