Extracted

• • Target
    SKM-97116373-PDF.pif
  • Size 322KB
  • SHA256 d6fce7f4f6a8c7c7ec013bd177f42ab0a9ef8d8ce6f505245ea09e41d33201e0
  • MD5 49fd93fb9699d57c47b6c1ae98282170
  • SHA1 2ceb5be3f5cc5f91862d866c2b6b695b144cfa56
  • SHA512 a2c41afc8a7fa52f309efeba8e31966ea376e6ef18870f59adf4531469c07cf2d55ed5ce46c0ea988da6d0e7cbb401cd8dbcf956ae27b21ad22259d1cdc8950f
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderuar3loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2