Extracted

• • Target

    HACKMS~1.EXE

  • Size

    712KB

  • MD5

    b0dd4bc52eb381a7990558aac569b64f

  • SHA1

    e8b81828b34d56de409d6cd3433baa7f38b5be78

  • SHA256

    6194da0d241a12d32e7334d0aa8a2b253a6e80e882d67842279b7a4160faa59a

  • SHA512

    f97c962965c2dfab030703a38c130438ec600011fb7ecf91732806a99f8e9d44e1e023bbd372aa0829a2a03b7efb20ccd788fbbeaddda27c995c48e0e9566a90

  • SSDEEP

    12288:4H2jynD0FV3hOrW2jynD0FV3XpDXeGxEiPvc5FJneuDlhza0FOjynk36ni:4H2ODPW2ODypDXeGxEiPvc54rOk3

  Score

  10^/10

  discoverysalitybackdoordefense_evasiontrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2

• • Target

    media.exe

  • Size

    301KB

  • MD5

    2e9a52594d64d75f396f9079b2332a4f

  • SHA1

    c27e2a039f792348c622bbb6812558d31382d226

  • SHA256

    1d0c59097b7a3e7a2eef3dd06989edf07601d7953187de35f99cd8ff4fc772f5

  • SHA512

    053285b7ce7c94f95486537764e5b4c9fe906aae5ea12a9d36a803b791e59251a330614885764bb6ae6608be93327f66081a0f3b7c121c72d456b5e18b239bfe

  • SSDEEP

    3072:8Jtn5ymi8Eu11uZaLJbN2SQ3N7Do0JgT5SVtoaKGlD8yWC242UcdRCU4J4lg4E4D:zKA9PnGmE

  Score

  5^/10

  discovery

  • Suspicious use of SetThreadContext

  behavioral3behavioral4