Extracted

• • Target

    JaffaCakes118_413eb6633763489d97627a1a70218cc2

  • Size

    120KB

  • MD5

    413eb6633763489d97627a1a70218cc2

  • SHA1

    0dacdb079a2d3f6cb25e93909101aa9af7c4be73

  • SHA256

    0cb26edf0f4230e4a46921bf9ddde8d5adb06e2a832e0ff64e559dac2e728535

  • SHA512

    65a9aa6d5711ce3f09868afc412be7bc34fc54a141e1c5bd354ea37ba08667544b4183dc4b96da5808cd02c2205e38ced71e496e2a8ed7d480e826a4e1ae36a5

  • SSDEEP

    1536:AVYXTC3OInAG+5qUqrzEZChdcZGCfRQ3DzUjpy6hc1r14ASzj+yTfV0qCVyQJ0At:A82ef6UqEWGCvUjpvc4pz9fV0FVDh

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2