Extracted

• • Target

    69a9bfa68efd5a566348de7880f14034_JaffaCakes118

  • Size

    944KB

  • MD5

    69a9bfa68efd5a566348de7880f14034

  • SHA1

    800b69e2e26d1fd427d3aae9022d83f2e7abb39e

  • SHA256

    56387db8f56fbc94d5ab10892e2df863e836284726eca564f92fc420bcec568d

  • SHA512

    64ff4db3180bccd2adf72efc7d4048ab7215694fd0489da55138595afeb363390015bca2d5c22e19c8c92a816da72cc34fc66f21a17d53dc1844f75d9a91a6b2

  • SSDEEP

    12288:YiIr4eOcgEyr9suG7/SjMhRmZ4TmMjBe1VMVi1fzwBKKyMgwi1ttDGkF4/KRVjuw:NeurH0/dKZ4TpQAwFmi1ttDGi4k6av

  Score

  10^/10

  darkcometguest16discoveryevasionratthemidatrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Drops file in Drivers directory

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2