Extracted

• • Target

    a346f470635c6d7ea825635f137a49a3_JaffaCakes118

  • Size

    496KB

  • MD5

    a346f470635c6d7ea825635f137a49a3

  • SHA1

    472fd1fde757a285431644bdc031419318dd386c

  • SHA256

    024e3850945fdc41ee63f0266be391ddf4f6689b6ec60da04cc6f7b23a3e91f4

  • SHA512

    c521dd15153e973522a61712d5b7ee6ed3afa58da583e952a90908a2bc7f4ec556ecad5beb4997e98f4a9026abca6c13314ba4ad5da4ef3b307f6036ac185843

  • SSDEEP

    12288:ViNl/fuW9tShIurQkA5d3In2gez4hFKMeRAi:Ql/mQtF8ArChrKMk

  Score

  10^/10

  metasploitbackdoordiscoveryevasionthemidatrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Drops file in System32 directory

  behavioral1behavioral2