Extracted

• • Target

    f5d597d94755ece3470c6b66217fe607_JaffaCakes118

  • Size

    97KB

  • MD5

    f5d597d94755ece3470c6b66217fe607

  • SHA1

    462e0c4fb4e8ada43ca53d7a10ebb6ebb74fe60a

  • SHA256

    de1226e7e5951af55880ca4a9f28b871e229a9ff6380d7bddc887648e08bfb51

  • SHA512

    2601e13e7d3eb18fe869060a84819cdc3588e3e011493df60e125e6e12dc4ee7286d6463f3aae86c6fd800c0690e9c1e3846935f22c9f8ad7bba97d3e3747dd8

  • SSDEEP

    3072:19jFDDw/CRyjydg6vZucon0KGuxUTG3R:19G/IyTaZH20KGuxUS3

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2