Extracted

• • Target

    dc583564e351eb52bc3c24dde675570f_JaffaCakes118

  • Size

    120KB

  • MD5

    dc583564e351eb52bc3c24dde675570f

  • SHA1

    7c8b82a12d9f328191bf13173596c4dccbf6bf2a

  • SHA256

    518f77c280c7b3c7761eaa9054aa19b01da68d164db16a6717789a5c947ac1f9

  • SHA512

    c5654d97044c31f98d7a3d47128b89116118f300a6180eaf9826482d5d8457fe6f1d04f1067b79b3466475d31b2934534fd339226e90da6f670d5fac5e15ff06

  • SSDEEP

    3072:sjZ6gff2+bdkKMk06LdLVHCTkWWXkP11eGXbIuGgcl:sjZF+Wl0OTMkJ+GWCl

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2