Extracted

• • Target

    ebeb8508fe2d16ccaee80d403335f779_JaffaCakes118

  • Size

    283KB

  • MD5

    ebeb8508fe2d16ccaee80d403335f779

  • SHA1

    43a850819978db4827d0a04ae3b7dbab7f33c8fc

  • SHA256

    dff7dadcdc880b4aeb3bc84f16b35f3600d673589984beb269140253d7fc4eb2

  • SHA512

    04d84906f84e806da8bdf004d34e7dccf8e2ea1c93d9fdece261df23f6c7ba81acc9fb4329f0fefd88c874c0c44d0968ccd95b6f13e8c68cd420dbe5b63bf5c1

  • SSDEEP

    6144:GJAfXNyqUk99BUXO88E1eG3O56TLs68aqdRcMHG+EmcG9:GJ4xn9rsd+iy6/s68RC+pEdG

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2