Extracted

• • Target
    EoH35.PDF.exe
  • Size 1.0MB
  • SHA256 aaa40ee2b509dc2b3a2f12f62d70565c85eb9aa13a7efd43bb86cfba0a3e1a88
  • MD5 0f03eab5505bb4a4df99ccead0fc28f4
  • SHA1 3b77986e8695f04266eb03393272a7fc66d5415d
  • SHA512 bfa9cd5a58bae5db8331789fdee64e30127b74f4fee95360c2029e0fe35d864207d2dcf25e568dcfd7b5ac9929b56ad522ac8064607ad9216493a56d8dd3aab8
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2