Extracted

• • Target

    JaffaCakes118_807455241f97bf055af1f4855afddf6b

  • Size

    1.4MB

  • MD5

    807455241f97bf055af1f4855afddf6b

  • SHA1

    8d200d13ad62dfbc60b1622fc6ee43d01aae64a6

  • SHA256

    04bd5a5530b3ae40c447dd8896142093f7daf8cfff5517c0d89ec72288c552e3

  • SHA512

    b1cf7aabc50465931515d553344e0f008d6eb3ade4cd1beabbbef19ddf50b99e10b690153eb3ad7a634448ed19ed05528853924cf96906c47a48f079a8a0b259

  • SSDEEP

    24576:LhPjyr92bRz3acy/qwMde4URWDr8zT2uwuqRJplVI5ZoLCkWUAaUdeBFZZzhIX8r:tjpRz3Hy/FMdeZRtz6FSZOFZZzhT07di

  Score

  10^/10

  darkcometdefense_evasiondiscoveryratthemidatrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2