Extracted

• • Target

    d626e10fda8d07e507fdb078431ad1db_JaffaCakes118

  • Size

    305KB

  • MD5

    d626e10fda8d07e507fdb078431ad1db

  • SHA1

    1499c2fd54b9a39cfaa8d915c56dbb2cd4def8a6

  • SHA256

    ea3a597366ecc26b8c3c23c00d7290762148d26f1cddd290efe669d2525f34c3

  • SHA512

    a87aac0d4f972a82cbf8ceadd273a6de80ba6c690b8b31f9267fc72f787cbc4b81c170044d2f5d37f7e1cf10d6dee53a2e91c8c93c4027075dd64c1c9ef0d1d8

  • SSDEEP

    6144:vTDILqF39/Dh3k4PfbFQh++qHC2959b2k8s9kvh233UJdEEWr:yqF0GfbFQvqZ7wkNivh2nIbWr

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2