Extracted

• • Target

    925bb25233da281843c47b4518d0250d_JaffaCakes118

  • Size

    119KB

  • MD5

    925bb25233da281843c47b4518d0250d

  • SHA1

    8b1c9a4554b15fb23bf2c1ed5db212b78507e832

  • SHA256

    e19a27753b1bbb06c11ee8f10d4fa64e872ddbe687cff591b249b75de9b005d8

  • SHA512

    abd509099e815b76b0ba551138b49d9be7997cbaa7d219f22ace67d4203f97e0c43b0456c8c8929aa5f0f581d219369a99e7ff9a85db00ec47bce22f2acb2b09

  • SSDEEP

    3072:iFJnmsxmJFVZDZFYFCrqhkKJXHS+W8DTpvgYSfout:SJjmJHZnGCrqCKJM8x4YSfoS

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2