Extracted

• • Target

    eb34748365c13012b9ac9cc72f7239a9_JaffaCakes118

  • Size

    376KB

  • MD5

    eb34748365c13012b9ac9cc72f7239a9

  • SHA1

    2b3950148a078a0973493f149eaaf43cc99dba52

  • SHA256

    eb521d50384f45b31ad8fd002b48429febdee7c02866ab752631f27b42b0721e

  • SHA512

    bffe9c7dc112645f9ab698ebd67364614b5f2206bb7092ab657e2966c784fefbc680d9e62f9a61b6480005e954694645da3f2ddf66c44c3630a8b41f6b85309e

  • SSDEEP

    3072:AmKxZkvuz8WClBs3zTiFGns5X7z4hJgKVES3Esv:A9kDlyjTiysJEJTCS

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Modifies visibility of file extensions in Explorer

    evasion

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2