Extracted

• • Target

    JaffaCakes118_f909a05f4b9b32a01ac10ecb62a63422

  • Size

    152KB

  • MD5

    f909a05f4b9b32a01ac10ecb62a63422

  • SHA1

    96ff947c5e09de2675c0401bd046de720b84c8cb

  • SHA256

    20fdf8c4eeb11d27e19e97d0380f6c12e0173cab58a1defcef4f780e25c7edfa

  • SHA512

    f4cd95a7abf2edd20f1daf37844175bda8703d5d7fd011c0c99c65802f381e01d4fa3220a079faba8283463af299cf5e1f5e1e0c832879943a8d097c8024f222

  • SSDEEP

    3072:dJVA/xtq3NR+GdgUhXZn5Za/rrGI4Dni68Lz+DB1f:bCW3NR+fUlZ/uHpX+DBR

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2