Extracted

• • Target

    f652a4ea9ccfc391a06300b62ee99920_JaffaCakes118

  • Size

    146KB

  • MD5

    f652a4ea9ccfc391a06300b62ee99920

  • SHA1

    619b2f9ac1345648be3f966bdf3f4abd78e1ece0

  • SHA256

    292746316301674ef6a2be75e3e11893dcb0391def7dc22f69e1684072d86fe4

  • SHA512

    28c349fed9b17b8ab66a07cda5c4ca258856057b5590da8884f0e225b018301d37faddac0e56cdc51005db2994a21bde720674d5dab85244cce806a7e3f42e2d

  • SSDEEP

    3072:O8DTOWuhe69/Xwwb5RUUg97QTyEzENEPuwRyrkcsHnFTSBe9hBwT:OFW769vwwb5aUgNQa6PMrhgnFCPT

  Score

  10^/10

  discoverysalitybackdoorevasiontrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2