Extracted

• • Target

    994f71a2e836a5573c51892cd861d77f_JaffaCakes118

  • Size

    44KB

  • MD5

    994f71a2e836a5573c51892cd861d77f

  • SHA1

    8eeee768621e18e73727bc660ef0c59813cec5b6

  • SHA256

    ef6da08c352bb37d39309452aea7102977e694c4f0d16e039e7e75603320e093

  • SHA512

    04d67e3c75eb5406ae3a29d00da6b0f79aea4f76165bebe896065be4c92ede679ea7a15188addb5b6308403457d188f20c21a3824d4ab316d8a6c47f3fdb54d5

  • SSDEEP

    768:8OBV+Yd09bhmYP9ZYgHgMpOzT4E9hbe/VYhZvtZwVMt09sCjpZJ6ODy72qR:YYd0bHLIh7y/eJZwVk0XjPJpD9qR

  Score

  10^/10

  metasploitbackdoordiscoveryevasionpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2