Extracted

• • Target

    JaffaCakes118_9e6c22af0433a806517fafc0e83e1574

  • Size

    194KB

  • MD5

    9e6c22af0433a806517fafc0e83e1574

  • SHA1

    1c9bb427aa29e8be2c4258bc1393fed578841172

  • SHA256

    dff10f255546c9373ba738c152c10251460ccd5212020aa8fa9cdf87b4eab0cc

  • SHA512

    2136c548e24a2f0f316a97d21504e94b5c9057188546819ac5006c075537c90513c7deb389fd2273f2096aa80bc32be1c2d5c8e9ef86b670ef579d341123933c

  • SSDEEP

    6144:WtvtJ4Xma2TbglDyIlIAfgSt4KO2iWiWsV:WtLTbsJIOOKOXcq

  Score

  10^/10

  discoverysalitybackdoorgoogledefense_evasionpersistencephishingprivilege_escalationtrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Detected potential entity reuse from brand GOOGLE.

    phishinggoogle

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2