Extracted

• • Target

    JaffaCakes118_62ad138031d2290d8afc118a766f25a0

  • Size

    174KB

  • MD5

    62ad138031d2290d8afc118a766f25a0

  • SHA1

    9f02bed50dc9e761309b495651071e70f084b17a

  • SHA256

    704d1c9f4c9504b278a6a366125ff5b5b229b9188c6d7d4613427e8bae63ece6

  • SHA512

    22b2a97bd179487be6461ed87d365f8cf4023a903576e256ad17c1f14b61b9fcc6a155ff4ecb413fe9247b0be3fc8e715851dfc1b6a254e8babe73845390b258

  • SSDEEP

    3072:L6zKqIoKEm4d15njUCNAQDHcCAHVRYG4ajfiTaXLnWLEI5x1Ceeu:QmEm41jUYBAHAIW8ZWDF

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2