Extracted

• • Target

    JaffaCakes118_b8e71a110e2d486a90a887936d53858b

  • Size

    139KB

  • MD5

    b8e71a110e2d486a90a887936d53858b

  • SHA1

    b88d920a4f81dbc13b1bd13a5d27bbd9cb95d4fe

  • SHA256

    0deeea06292d6f54ab0411b538bf7cbf5128db7cc25f7e1072249389ef30f19f

  • SHA512

    8479b9a50c3fd21c9fdb84664cd840e1c07bf633986e9f949e79a027705c85ad0c2ae274fd0d744c3461a8ad3520dc9022d98c1a45699820747b08f6542f6b3f

  • SSDEEP

    3072:KDS20lw3+UeIybszdQGpCt6+hOJYRC0KlZrmhqY:KOQ3+UhuszdBpA6piyzrm4Y

  Score

  10^/10

  metasploitbackdoordiscoverytrojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1