Extracted

• • Target

    JaffaCakes118_7ae0e477408df5662fe14fc6f0816347

  • Size

    606KB

  • MD5

    7ae0e477408df5662fe14fc6f0816347

  • SHA1

    6a58323739786c2984fd31fcde6cfa1f0a083544

  • SHA256

    3f9269b33608d91afaa2dc287d97d2b1b11daf0961af164945bfb9dba8ee7b4c

  • SHA512

    69b1e6861aca32225498214d6692c47478502549fd256afd1bfa74afbab6ef4ff9153810a639b2b4be230280d74d61d820c1f8457953623ba1fd7c895672d27e

  • SSDEEP

    12288:URidtjPWedI4ilnP/TP7xQLtV8TuJ+fUoy6SoMvPJ6Q/FO0cn2b:URidRZ4nTVQLtVsuEfUoy6MHJ6SFOW

  Score

  10^/10

  modiloadersalityaspackv2backdoordiscoveryevasiontrojanupx

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modifies firewall policy service

    evasion

  • Modiloader family

    modiloader

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • ModiLoader Second Stage

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2