Extracted

• • Target

    JaffaCakes118_819fbebe4bd635417b243ad07da58e35

  • Size

    194KB

  • MD5

    819fbebe4bd635417b243ad07da58e35

  • SHA1

    7d6bd4b74415adc880e846cf7d3b966d4315ceee

  • SHA256

    cf2143a2a892d8a540662b44a71ba00d39d208478ff12a580a94eb957d963bfa

  • SHA512

    1b618496166cce9e29004658aa289809a5362f12c35a18e0bce8097c1750509190adece43766c1f8eff7a182e4cf77cb2c937b323a18af7f14e15e415c621f3a

  • SSDEEP

    3072:S3MBpYsABHc+FFiTaNefyE7G92dS+SAaUZltZm7L3xdXg:SZBJJ0yE6EdSLU/Tm7L3x9g

  Score

  10^/10

  discoveryupxsalitybackdoordefense_evasionpersistenceprivilege_escalationtrojan

  • Modifies WinLogon for persistence

    persistence

  • Modifies visibility of file extensions in Explorer

    defense_evasion

  • Modifies visiblity of hidden/system files in Explorer

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2