Extracted

• • Target

    9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118

  • Size

    220KB

  • MD5

    9379e4dd4395e4d2ffb830f67b7ce372

  • SHA1

    6ece4a645b5ef91b090650a9c266c219c15dc8c0

  • SHA256

    fadc8946fcdbaddfe31ab48968e84da81d9ed0f403ad49e533dafb2907b97373

  • SHA512

    e2f484d69e7189d5817706f5bc8377e081fee8a77a8c04c894131d95eb1b6c0c60c4eca84561221d06cc248a9e8c2a93dedcf750f1ea617fa2f1563d0d8be1c7

  • SSDEEP

    3072:SEweV9Lijj7mO9tOrvgKplY6hR0Q3RIRlF13jFA4mrtPp:SEweRgMlY67dh6P1zW4mb

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2