Extracted

• • Target

    JaffaCakes118_4fe13b6bf11175ea69a4b947de88ee4d

  • Size

    100KB

  • MD5

    4fe13b6bf11175ea69a4b947de88ee4d

  • SHA1

    9e92c462107f46903912aa59ce38375d604da468

  • SHA256

    47e48f6cea83b07181e0c05317853641fc5f039731f3f8ea58cdc250834b96c6

  • SHA512

    26dd615e7ce1cc0c84a6b913a600f496b17a235d72f066bdceacd59bce223fac884c244e2bc5b8e949465484d85a01b13bc30012ff5a1a4b9a7fd1fdfe744379

  • SSDEEP

    1536:UxqYh9tNVGknwhXN5HDUlNVrq0J60GG5EqnJ/+75PVW7sFR6WiY:UxjPnwkng5jURe0Y03xJW75P87mbiY

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2