Extracted

• • Target

    35ede1474953109f82d99ffbf98faefa_JaffaCakes118

  • Size

    2.9MB

  • MD5

    35ede1474953109f82d99ffbf98faefa

  • SHA1

    ef1f8e06a90bf1304f6d19e61b58d8b045cecce9

  • SHA256

    d6dcde685eda9975475d6a885d4d8a8a94e687d699656221db9f3fcf50892e1c

  • SHA512

    7064276986d6e84943fd6232de664d7ae25e2fd9478ad622644a82d72130f3b9b9aac25ebec4be5a075371763d909ee95612b94bb889b1d7f72691a1781dfd4b

  • SSDEEP

    49152:tEkCc1TKVhBjpvZVFhqBt4maeIHN74NH5HUyNRcUsCVOzetdZJ:pQLH4HBUCczzM3

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2