Extracted

• • Target

    e5c5bf8c972a348457423451beec4895_JaffaCakes118

  • Size

    120KB

  • MD5

    e5c5bf8c972a348457423451beec4895

  • SHA1

    5ac90136aa63fee1a492233fc9876ed4021bc51e

  • SHA256

    0b37361ab33f4f47df4293bce275871b62192a383276a016347bdc3733aedb04

  • SHA512

    6a388818df375879db959e0742399c2ef296b7ce565ffd6886ae06d51bc2a74e8b77d1c9c6ac8bcbc8a75e96e00d069add199a7c5ce84920f8bb35d9b746ea62

  • SSDEEP

    1536:F5UQkVwu3gZqgrEdpeuaygr/A2UnereFn0Nc2zVjCkxrC:F5HkauQU7dpehygZqe1Nc03O

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2