Extracted

• • Target

    b1036e6beeadb6526d152575a7675045_JaffaCakes118

  • Size

    211KB

  • MD5

    b1036e6beeadb6526d152575a7675045

  • SHA1

    e43a6754535e12fb5af6af690d5cf44dbcb68a28

  • SHA256

    f5f307d772203df45f9e57fff7583fb11d80021006f59544e89dbb00186953cc

  • SHA512

    8e71bbad7433e02e88e8ef2fdd7bb6cf37cd1e6de644dade643971ba0805e1266f280ed7cf3e6115150681809b8fe8f60e68652c3f506b3e89e5ac6da7b5eccf

  • SSDEEP

    3072:ef9EBCJiutMZF75lVLVskwUYCh+vLwMVtQbeDqHWV6lT246HXVFmqt5hWtYg:eeB2qV7wUr4Tw+tQiDCW692PFPrhkl

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2