Extracted

• • Target

    JaffaCakes118_446c6cceecd7f0028cba744efcbb7097

  • Size

    923KB

  • MD5

    446c6cceecd7f0028cba744efcbb7097

  • SHA1

    ae7653ccc711e0f4846f85ade75e97f9384d61c1

  • SHA256

    3df00745af3a52c35c0df1108c8d2121666d972af4bf2bdb913d1e5c64649830

  • SHA512

    00d0c129c127f94264a043101ec1527a098f105c87af16cb4b3f2b4db4593bcabd1433831f925223fc6506f28c884bd04dd0eea6fdd17d8e5aff14e9be3adc77

  • SSDEEP

    24576:ipm8d+paw4T/5IQ2KgoOLErprzU/V3ZitQh0vt8/:IxSKgoOLE9MKCau

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2