Extracted

• • Target

    JaffaCakes118_aee71f06c73efb75583902806b5dd063

  • Size

    672KB

  • MD5

    aee71f06c73efb75583902806b5dd063

  • SHA1

    74741cc93b49697df82fdccc4972efa861db6fbf

  • SHA256

    44f0de80499a52b3cfb0283e23817d85d0954d9a30bbdfc77c803f9961251cab

  • SHA512

    dd08d2b70514526c75566091c7b81b08b619db88475259b8a66b60865f551209c6ccce658bbe6705f7357fdcef5307ad0a7d217afcf393626a29ae5003507fcd

  • SSDEEP

    12288:l0/zSknQsmbFlXTPhvHA7azeJ2B4IfcA7iNkSRyvi4K:DNbFR9A7aC22BYSRcpK

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2