Extracted

• • Target

    9db6aac91edecc05b4ce04878fde8dae_JaffaCakes118

  • Size

    556KB

  • MD5

    9db6aac91edecc05b4ce04878fde8dae

  • SHA1

    682b224df4beac1a0518736dfcd93474e3a3eb19

  • SHA256

    5dbae2032699625724f04f9d853144ff10d2ee913c7f57811ce3a5e448a4bc83

  • SHA512

    5128e02530518707717ee3ad2d4f2ca4bc285a2127aa5225313ec36419f65d4df5c8e366cd9ff89af4e3e422d562c9a0fc5e95d6b0acc26604d35185857dc03e

  • SSDEEP

    12288:XOjonaDXZ+iA2VuzIeJt3eDiPC0opTqTDqbGUJOVxtm3Sx3Rt30c:i7Do0010qT2pJOVxj1Rt3

  Score

  10^/10

  metasploitbackdoordiscoveryevasionthemidatrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Drops file in System32 directory

  behavioral1behavioral2