Extracted

• • Target

    JaffaCakes118_5712ba644cfa197932aea2cfea43e0d0

  • Size

    957KB

  • MD5

    5712ba644cfa197932aea2cfea43e0d0

  • SHA1

    77d9097fde324508da4d83edf5bb6bd56ab8767d

  • SHA256

    f73048cbd3d0f32bf6c0a6ec68940e7d463640c3ebe1232c1943015dfa3b5156

  • SHA512

    84b445edd6fcbdac5a377a83b5e4561fed35fce1bb60a70375f9f94d6b4f5039cf62da434559f708e6ab2d91349b49d107dc9d2fb420f01b7b735e1bd827cbd1

  • SSDEEP

    24576:Aw80K41Abnoc0GuUNkkuhlvdohVVK9j/JRbUgka4KmhgrsuDDJso:Aw8wRfUN/yr+a9NVUgkaTmhgrXvH

  Score

  10^/10

  discoverysalitybackdoordefense_evasiontrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2