Extracted

• • Target

    JaffaCakes118_95350b439ce2fdc5f438199ab6f6e866

  • Size

    89KB

  • MD5

    95350b439ce2fdc5f438199ab6f6e866

  • SHA1

    65d874e5d6ad7818c40d8be3fa706b83da718140

  • SHA256

    321e2dd4eaefa96d785b77ea58066640e50d9d53f7a15e319a1a1cfba952e555

  • SHA512

    a5fc11160f92433a0f3f5348fad65a8c038811cc6f595afbe6e7a502d5a18158a29239db3c820b7c9ff8b15cbed2529edeb18306ffd85359a94c8a6e37c5975f

  • SSDEEP

    1536:OOpOWmH4UIbiV8EEhHX4VOykVf25lOjBXIhKhRGsqsQVSpvwE:VOnH4UIbiV8EGHX/fUluB4hKn9k2

  Score

  10^/10

  discoverymetasploitbackdoorpersistencetrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2