Extracted

• • Target

    d262e31f7064b37c64074f3efdf5d4e7_JaffaCakes118

  • Size

    120KB

  • MD5

    d262e31f7064b37c64074f3efdf5d4e7

  • SHA1

    481888d41074773eb6895f6e29f0b330a6c68299

  • SHA256

    66cf90b846d0281d98709495a6bf53b67ab2d34f7fbbe39a9109e8cbbd73b16c

  • SHA512

    bdb05dff21cdc7cdb06ac36c68b80fb2dc81c5508dfd56051e087b526f5ba11d5c5072ac30f8bbd483ec879602af4720efb41b2f7b1445026311d0f391c9d483

  • SSDEEP

    3072:wNRl36AZXorwnVNnHvXmdZIP7CB7dJ8hq:ARlDPOLIGBdJ

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2