Extracted

• • Target

    JaffaCakes118_4342c64738e12a84303e4592e9a4a882

  • Size

    3.4MB

  • MD5

    4342c64738e12a84303e4592e9a4a882

  • SHA1

    aefeaed87862130255090ecd98d07c9bd3b81d8c

  • SHA256

    23e3ab7bc781a79ac6ee3d4c72c01ce24ed06688251bfe39e1f7aee82f5a1ae6

  • SHA512

    23107a9f21e03ea37e2124000ddadfef50b0da974acd71ba3bef938cf3277a2d3f0602d5ac28cf91198fc17041b7e4431cd1dce7a67b3d7f8376010a75566e9c

  • SSDEEP

    98304:Ow6YhCrNyctDPs/BNnX+ICRVbZt4G5byJYZ:5grk2s//OZOObyi

  Score

  10^/10

  discoverysalitybackdoordefense_evasionpersistenceprivilege_escalationtrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2