Extracted

• • Target

    JaffaCakes118_44e8be3915ad13e5f47cdd72568dc3a0

  • Size

    1.2MB

  • MD5

    44e8be3915ad13e5f47cdd72568dc3a0

  • SHA1

    1d0b23716e5f0f05eaed280034b022eec5219bee

  • SHA256

    272c9bd5c18c4063064002d34485502eaf00148026749e5a5b7e928abad92706

  • SHA512

    37e33e47205446f20b0d8f57e66828f4e67dc7e2c84795b46ebf6115a3ba3a67a3e01b08e253accb84dbeaef6ef4584a4e55368e30bc02483eb89d5b3307d706

  • SSDEEP

    24576:1G0MLNN1u7y7PsS5TnHqt6oGNyC2xQ1/NTI0YhpNt:1zMLZu7uTH26oGNyC2SNuhN

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistenceprivilege_escalationtrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2

• • Target

    $PLUGINSDIR/KillProcDLL.dll

  • Size

    32KB

  • MD5

    83142eac84475f4ca889c73f10d9c179

  • SHA1

    dbe43c0de8ef881466bd74861b2e5b17598b5ce8

  • SHA256

    ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

  • SHA512

    1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

  • SSDEEP

    384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    c17103ae9072a06da581dec998343fc1

  • SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

  • SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

  • SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • SSDEEP

    192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

  Score

  3^/10

  discovery
  behavioral5behavioral6