Extracted

• • Target

    JaffaCakes118_46c1f67db0c4e68b26089d3520050afb

  • Size

    100KB

  • MD5

    46c1f67db0c4e68b26089d3520050afb

  • SHA1

    4e320e56e2cf29e82e83f494323f349866eccaca

  • SHA256

    46cd04b19689fa06a40bb700fc8e30d168e93e6e1e56a3ca35f4f34839a82695

  • SHA512

    4a6d9e9b7f8add905b326e3802bbdb50e6a123c45c26e4a62139ad19c18a535fbe689973fa02ba966b4b2261f10f6d0d2acce69256203c364ed7afd761bff945

  • SSDEEP

    1536:vlWwni0Os/tQifeq1RzHBcRBPpg7N3Ex9XbHiE83H4r+giCShH9zGXX:vl/cs/tQivzhuBPO5Exdx83H9thHJGX

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2