Extracted

• • Target

    f8ac92495de30e2c7bd71ad164b64709_JaffaCakes118

  • Size

    120KB

  • MD5

    f8ac92495de30e2c7bd71ad164b64709

  • SHA1

    c9eed74f94262100fed9a2178c8fd347509b355d

  • SHA256

    72f3029eaf9f1c88f483d6e692fae66209cca16d0d2d7f8f217046a8aa129019

  • SHA512

    f613f7aa2ddb79017b7ee6bd71d68ac9988f8d79744486329a837f2f8a48f8ba4e9ebed5e71bdeaa2e7cb13506143839590e294485ac5dbfc556142f6d8f95e2

  • SSDEEP

    3072:WC/+oOHfFN1tGY4N1ScOavAelL82vHg/F961sVh7BjC3:r+oOHfFN7lA1ScOarL82vHEF97jBj

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2