Extracted

• • Target

    JaffaCakes118_6cce315adf60ca01d4fde09883af8991

  • Size

    120KB

  • MD5

    6cce315adf60ca01d4fde09883af8991

  • SHA1

    c49a0d24948ca36d7fd9304a2e990ed32365b515

  • SHA256

    528d13880a480efce04315eea79201e76a311e9d76140765c58291050740e9b9

  • SHA512

    0df93f4f4d25156dd6f7a9a89203269217cc2364385363f7b89a369baf8bc180d1b2c5780465e1f2029da47174b1b83c39130399d4913e2ab37ad5d4def7fe97

  • SSDEEP

    3072:IgpIy/MBOovyvm3r4PvXNPMYhACjmd2XDsRFnK:Ig1MBP6+kPvXNPBXjOku

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2