Extracted

• • Target

    JaffaCakes118_97d984436c700d6b5e8a62ccdedd13a6

  • Size

    120KB

  • MD5

    97d984436c700d6b5e8a62ccdedd13a6

  • SHA1

    02ee7709b022be94aad13fafd3ca415e6139b136

  • SHA256

    452371c81ad4672ce0acf32c4757305d2962488906f169bc22e43791c141d757

  • SHA512

    f525ffbeec9da4206a0633b9b4671c5a9c71f206d32b81a95c0244f5e2c83cf21cf81be37b98998a829ef4469999929cc2750692043615c758bd0458546d3810

  • SSDEEP

    1536:B2hk0TzyMLxL/Pmu2WrHCqu/FDjCB9/FdBg+zaWv9aqAIw0wF:B2RTzzv3TCqu/FnCB9T6+zaW195rw

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2