Extracted

• • Target

    c7fce4548ed590d84f16aa2e39101ea8_JaffaCakes118

  • Size

    500KB

  • MD5

    c7fce4548ed590d84f16aa2e39101ea8

  • SHA1

    c7f4b649bcfdd6ad3c98aa02e76f5a5174fdc253

  • SHA256

    322a3e84e58c1937e409f8814493a6a2af106e17bb35e71084130fc3332e815c

  • SHA512

    55235f8d223b01a172c3f9fa1687488cc95eeda84e14aa6583c2d62741c781c4fbbb65a5b31e846d619308d7d8fc0a41a3908c920c214f25ea6a16202ebfbaf6

  • SSDEEP

    12288:qWYEPxe2OjeL+uQymrLLVYrtIxFZQYlTGTFTjU0r6gk0kyIf7E:qWreJk+uQymLVG+hTu199k0kZ7E

  Score

  10^/10

  discoverysalityadwarebackdoorevasionpersistenceprivilege_escalationstealertrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2