Extracted

• • Target

    d98a75d28761614c25ae20efe80e4d17_JaffaCakes118

  • Size

    292KB

  • MD5

    d98a75d28761614c25ae20efe80e4d17

  • SHA1

    ef1630838216eaa80a940275cbdb25a9210da6e1

  • SHA256

    50b7ac01018a604bbc0fe90b7514716c1093f3f9766fc044905c318a2a3e3f77

  • SHA512

    3f2d5e6f25da6af05ee2d600a66031235d4bedae39fb0a56b1d4c7b53fc7525388832171d5661d953d0d768e7f2100dc24c30f19d6b6151e20d5d26afd20a2a5

  • SSDEEP

    6144:XIaYX6rO+MpmqaCOK15DetQv9ha1m2g6SJmIWte:XIbKrHMpm85KtQvim2kEICe

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2