Extracted

• • Target
    DHL eShipment invoice_pdf.exe
  • Size 329KB
  • SHA256 3926f5e7d90bf6eb1f4b3cc3d38570efd19438e5c5d9fa8b02a8a79fdad8ce4f
  • MD5 fd7c314919dc9f7b091f97b8bbda6733
  • SHA1 268982f06971cb1313857813d8e2be86e79f421e
  • SHA512 ca905513d6c77f2ef082ed5295eda965e17e3381bdfec30d59e5c93b6170d3a2e60496a40d660e687dfe6a79c5e9d476c7539ba6f48be2e0160a34aab4ce797c
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderloaderransomwareratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2