Extracted

• • Target

    JaffaCakes118_56d8c7c80f9cce10e8e2a9ac5ad1ca3b

  • Size

    760KB

  • MD5

    56d8c7c80f9cce10e8e2a9ac5ad1ca3b

  • SHA1

    4d3618cdbe83d7b6190800256a0af6dcfa75022d

  • SHA256

    20dcf9b3853877bb7939e4e8ff760cdc13024168ddfa33f9d8ed06b4fc74981f

  • SHA512

    1eb5a6e0a41e16180db25a25bc549853ffa214eecde207e3fc0592fb61825b2ba8af1dc359bf2933485f2776dd404ff8851ded18692fce785c6b151d60415a43

  • SSDEEP

    12288:l0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv35ELkfXExy89mNmvZ+:lfKbT5lrPo37AzHTA63/cfU9IEU35TfH

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2