Extracted

• • Target

    JaffaCakes118_8a161e7377c7bdfa9bfa1f589620157e

  • Size

    1.2MB

  • MD5

    8a161e7377c7bdfa9bfa1f589620157e

  • SHA1

    85fd9cbb854689cadff3063b7761421702de56d2

  • SHA256

    fc412e059e1544d9ee32e147db10dab9e6662897b38e63929c3bc1481d8f9f04

  • SHA512

    a7448c52427c2c46ce2af0feff50d3df6304ac9fa913a0843684484792456a82a9d6eaf05835536b02de97b3ff055e40aa6ade9bd7fc5596504dea85d98ca1d3

  • SSDEEP

    24576:ITr9yu6+nJuGRYVZ+xc4uTYITsMPV1UKULilYVRN5O:ITByHYJ8xTYITsokTLiCVRLO

  Score

  10^/10

  discoverysalitybackdoorbootkitdefense_evasionpersistencetrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2