Extracted

• • Target

    e1dc5888fedff477c8981033c0ce8cc1_JaffaCakes118

  • Size

    479KB

  • MD5

    e1dc5888fedff477c8981033c0ce8cc1

  • SHA1

    ed43653bf1aaecc49781a9dd4944f7cab17fcc0c

  • SHA256

    aa0b946052c581c3c508a790fbb013c54e1d13e4e9b3ad11831ec5ecb9e30f73

  • SHA512

    0d51d5e7942c25479b60b35138173bbaffe0c3f944ae4ac347daf4343638877a92fe235ff201f05fa03920188b8e824c08598fa86dd26cebd341f2c273bc8601

  • SSDEEP

    6144:aVyB5/2zBiq94jszVBl+rXfM2DyAW0bFAtD+T8NOpXaSsiiwuR5ZwEXowLF4/6Ji:L//aB1jRnNEV+wGZwEZLi/p

  Score

  10^/10

  discoveryupxsalitybackdoorevasiontrojan

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2