Extracted

• • Target

    JaffaCakes118_af18e17e3a378c8c90fdc0a9b40da893

  • Size

    1.9MB

  • MD5

    af18e17e3a378c8c90fdc0a9b40da893

  • SHA1

    1b45caf064d0d68c14ea5dabbb66e08c6ecad30f

  • SHA256

    c2be2eb77600a608bc5fc77d3522191af799b176694dccfe99df6283a61818a0

  • SHA512

    50ec0adc1efb569e0611300b6b09c7bc962a6703c8b44e2ec418e150c8fac191d878629cb1f9021da971979b5ba1bdff3728dbb16a091b396593662e4a144353

  • SSDEEP

    49152:j7Kpkldp8AM8TpAo7LVAMjsPv0ew/9mlQf:RbB/NF514n01Uyf

  Score

  10^/10

  discoverysalitybackdoordefense_evasiontrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2