Extracted

• • Target
    INVOICE.PDF.exe
  • Size 824KB
  • SHA256 a1b6ca8644c7908a5ee930558144d794e25a5a6a0bea0637396caa161ea04475
  • MD5 056627e22924798f3909231a045d44e1
  • SHA1 8f82ea5bdb6e9de01c281642ba2b67028ddd0c6f
  • SHA512 68ba04b77caa124b80e541c0e729f4397ba854c32b09807f2f8eaa93d1270b3c1175fd12c201322fa6e06565bd4068b03db84377b62f9f1d044699f4ff8aa3d1
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderh5jcloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2