Extracted

• • Target

    JaffaCakes118_8b5ecfd8c02d9f39a1ca89650375eddb17642ea1a745c6a466ae83750e460e67

  • Size

    2.3MB

  • MD5

    ef0a7f6b37f5a9292ab64f540ccfc481

  • SHA1

    9e3a69ad4e885aedb24d4a7c4deae3a09b1e4dfe

  • SHA256

    8b5ecfd8c02d9f39a1ca89650375eddb17642ea1a745c6a466ae83750e460e67

  • SHA512

    9b2e1734228f808b43b71d39bcd47dbdebdba983cd488b7791ef8db8f68c4bc98cbca05ea0561e6642d0242a15b8d846cff991a76c23a2ee139a5341827b409e

  • SSDEEP

    49152:2te5uI3Oe4DiBqcWeyh7p4JumqBq7CdJyWzqPGmTL5x:253YumB7C/1mn5

  Score

  9^/10

  evasion

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2