Extracted

• • Target

    JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de

  • Size

    235KB

  • MD5

    b815adf1356fe79d0725d9206c4fe8de

  • SHA1

    a3efc104cc279760ddc1352bfc18401ed370be45

  • SHA256

    1a63c81d2139fdd80446640566d3453d8b3055f06041d1e8269b2ada78bd8933

  • SHA512

    09228995cdffb79afa7adaa33fc711a4ae4db59759d161be6a7a8da7e8695948b45adb5720ab3d418767184c992bb185bdfdf095e0fefedd7919b2fa0725dc85

  • SSDEEP

    3072:IUgB1IDkLnDaj0lTjCHCzdtZ8pmuaJlQwvV0ruNbAFQUTkscK80YlOJD1:KBrDDaj0lPqKFDJlQ0cmAGClKK1

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1