Extracted

• • Target
    DF_Nueva orden _WJO-001,pdf.exe
  • Size 1.3MB
  • SHA256 61a69b0eb00727462d5599153fb2acb617d15fcc2e9e4ec3270a5fca8837a3ba
  • MD5 962ae24141e7b1abf36ae99d1fbc7315
  • SHA1 bff36581aae1b402d2542190d89faf07fcdd2680
  • SHA512 46f9e98ad3440d8fa079ca7431face86ddf46850de4ee7f5c220ac1fa4738646a6862e0895797d83e52f9b1f24117b7259ac33b02405ac72f0135e8ff33e1072
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderb65iloaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2