Extracted

• • Target

    e9bd4c8fb1cd2b62716375fe9088eb81_JaffaCakes118

  • Size

    74KB

  • MD5

    e9bd4c8fb1cd2b62716375fe9088eb81

  • SHA1

    54e408d6c2b38318e00ab8f43dcb5f27a9d1f463

  • SHA256

    e0c42e1ddf6c7671c260d9a4e764a17d0b07845d9d2e7d15717d7aa9040ca553

  • SHA512

    8cc1316a18d211f9b52dbc9f3812e966ccb4462a4b6ace01f7d5ddbf5c6081a57a917f80f7e8082e764293254d403770f0eaff10f0e6015deb16b2984807ff20

  • SSDEEP

    1536:jc0oQJlEPEcbpnAr6+vpVxu7l16n5OpoUR2/PCfFlsehgoVr0GHSW:jfJrEP1irBHxuba5OpoUIPuFSQR0GyW

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2