Extracted

• • Target

    fc833bf26a3c90f319a7f29a3ee54ac7_JaffaCakes118

  • Size

    198KB

  • MD5

    fc833bf26a3c90f319a7f29a3ee54ac7

  • SHA1

    26ee0ff687d7fd4521a1ea7f0d8e46c490b8718c

  • SHA256

    7911cf03da7ba98c98d76730441c378a32daa0f12f7ba8b121d0db9ccf4920b3

  • SHA512

    91ad98fea6765608a7350ee6e1cbfcb1ca9cd8851d2d3810cc2d3d910e04e4723783a67e4bb7a596c7e7ea96c8d5aa334ab67984b8424ad76854135c76198aba

  • SSDEEP

    6144:QjWq7chPrO02BNnqLqoHMkrxX87Ltgg6ab/5:QjN+jO1BNnqLlt5itggBT5

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2