Extracted

• • Target

    f45ba1d46debf5df8ffd9fb3639f4daf_JaffaCakes118

  • Size

    232KB

  • MD5

    f45ba1d46debf5df8ffd9fb3639f4daf

  • SHA1

    4f26613249f597c535039e6f815d318f96ab29ef

  • SHA256

    34cb613dc986a0c9f64bd35f761268e462768545d1a769fb88e620c2ba5a8de6

  • SHA512

    9a9e8d4709c891b6eaf3d9fb69623bb28d96b4e34488b104b5d68161db80921dcf1bc4cdee2c9a73581a254692301ab675e977a895d87c1225806dcbdd4d78ac

  • SSDEEP

    6144:GkbpuZ9khCYmZ0bDyGj9EylVv9wtGaVCo7Ksvm:PbYZ9ok0ffjiyv92d

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2