Extracted

• • Target

    JaffaCakes118_60cfaa931b01a8f08ffe203ec8506080

  • Size

    811KB

  • MD5

    60cfaa931b01a8f08ffe203ec8506080

  • SHA1

    8fb983e216e23bc857d1a90ef63b00ac3b9c9a88

  • SHA256

    101c0a9d2fa8c5a0458bebd09f231c907b2ffd0a1e631fc462bd70d3e290ff29

  • SHA512

    cb07b18b4c83ff26e9906545b8f82698dc00186f4bc9fa286fbdce131f81d3134d614ce8ba0967bc58f715029a0e8a883be4c660c121fe2c816e44a29127c878

  • SSDEEP

    12288:gRm0OqZQDi02wPW6QIHd4/vqUfcfSpKUy0:K2Dd2g1z+3tfYSpL

  Score

  10^/10

  discoveryramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2