Extracted

• • Target

    a28b528c73a2e5e06b5b535db03b9132_JaffaCakes118

  • Size

    142KB

  • MD5

    a28b528c73a2e5e06b5b535db03b9132

  • SHA1

    6b54ee539c8aacdb7b9cd5f6656977019e4c834e

  • SHA256

    c57f93ef59e128b92725fa21ea639eef5762db792fd5d9f408a439de976f7573

  • SHA512

    485e1ad7ac5781a36ade8e6c233d76c97c723790a3a9c7c817b307023a77d05f295e9933ad9a6da3ef309f4c93acb04102ea2013f62d24c1a33f5fca395a09d4

  • SSDEEP

    3072:9N4+69jpWSbgg8LFBAXmlwpqUFCYKwi5s/b:/47jFEgYnA7D1iM

  Score

  10^/10

  metasploitbackdoordiscoveryevasiontrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2