Extracted

• • Target

    fb6006fda4730c18e3d4af9b9ea3ae46_JaffaCakes118

  • Size

    203KB

  • MD5

    fb6006fda4730c18e3d4af9b9ea3ae46

  • SHA1

    80563abbdb2f86874ab6c847903f6393316963c1

  • SHA256

    708673c81e6659c82632dcf2294cbbeeabea938b027aa0dee42bb18c97dfabf0

  • SHA512

    5eba48aecac9b14250d3475907e5ae3125b8b6ef0dd1a56f231edd75bdd0e58619300be3f4830667fb1ad8103bede28a62d97ca398b548b6989a49a3a46c9c72

  • SSDEEP

    6144:O6za8aMFQ/3Cc2bwP46ugYzoYrMLaSi7U4h2I:O6Lal6MPju3oXi7U4hB

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2