Extracted

• • Target

    d28274894da19ccbcad3a2ed93da481d_JaffaCakes118

  • Size

    311KB

  • MD5

    d28274894da19ccbcad3a2ed93da481d

  • SHA1

    911a426e6f31e139f14fca3ef39ee58777d00746

  • SHA256

    a6bcf7096614b005b4a76df83fa07953cab1a342a245ccd58eab72bdc0f7b6dd

  • SHA512

    5049fe6027bf1c86988439fcce9107abc00794018d1c53f26c5ed9e8e0da84755a5485de754e4f98f2470f9871cbfacf9533f3de10779a44f2ce848be494c511

  • SSDEEP

    6144:sTfFDbRnOTWbaRGm4vUW+t82MmRu+F2+UVm3Ar8QsVgbomacS0:+5O6m4vo7DU9oQB6cB

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2