Extracted

• • Target

    JaffaCakes118_49fbaa63c0ed01e038444818f8366be0

  • Size

    224KB

  • MD5

    49fbaa63c0ed01e038444818f8366be0

  • SHA1

    c170d10a425cd05431b8a9cca5f07ee0a089af30

  • SHA256

    04c2f85e223af06cc82c14f65cad0bac65cba17c8e05819c5f807af7a6944878

  • SHA512

    1c34d0bf35fd8f434d57aad010101a4e018c600e1907e3a2a9e1bf6cfab7aa6865d56d1ec53a146e0ff91665193bbbee40012229baca47c1c165beacf5f3360a

  • SSDEEP

    3072:LNcA+i4uhMepnmqqnsZdysdJzTFr1MJOfc0p6eDRHr5QsdkejMELG:pcAfhMepgntsdH+Qf7tBdk2LG

  Score

  10^/10

  salityadwarebackdoordefense_evasiondiscoverystealertrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2