Extracted

• • Target

    c0bdcab5b330f0061cfc9cf78d290022_JaffaCakes118

  • Size

    204KB

  • MD5

    c0bdcab5b330f0061cfc9cf78d290022

  • SHA1

    5ff889e8a2d5aca669af50af205c34583e6382d8

  • SHA256

    e4315f5a51bc76042f9fa09a27a6e8dfb79ee0a480bf03db7c3c284ed3653fbe

  • SHA512

    0ff1dc742052adb2b8603bfe0e21db66180ba77c0b822817df34e48e5644de2ef3d269cb4bee5ab41264c6a0bdace0a9d2092c6801cd89529beea18af0a499f2

  • SSDEEP

    6144:gdZRVIkxJER7arwtdX00YZ88aH6WwQ1kO5/8P:gtJi7BdX00YZ88aHuQ1kOCP

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2