Extracted

• • Target

    d07c0662b0d4eaf566c40282e023f832_JaffaCakes118

  • Size

    155KB

  • MD5

    d07c0662b0d4eaf566c40282e023f832

  • SHA1

    9c4e9e131203b9ff582aca55e6122891bdd1f30d

  • SHA256

    a8dc459bf9158255f34198c004c52cca320ab8a5d2c52d7e8226c2543f861363

  • SHA512

    c73a127c403c2eaa39cbe0088d22d7891698e62b06c939245186b4d0e51341c302aa684fc69aa15524e92f8f745906c04f6822fd0cb34a433ac7d428d7b8cec6

  • SSDEEP

    3072:pHKrhJJsrbBNOYkgZsXjMxZqdQubEennvowbsHlMo+3YoVfyf:Rmsr6g+XoxUdQihnIMRISKf

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2