Extracted

• • Target
    Order-9411574-pdf.pif
  • Size 249KB
  • SHA256 d0d523bb3e44390067122f5b4768ee44811c00f14a344dd70e71d4c2bcf4962d
  • MD5 58e91c804bf83bcb330d64d87bdd7abf
  • SHA1 9f00f81e64cbe3445a1f3f5f24976d736e8543ca
  • SHA512 aaf401d5f4a35325677ba978d170204d1305759c763b3d345d2817080cfb0707acb3703548f29db2c520faf3f2ba8835adeec435da59dfea1d3c03527f400ddb
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderuar3loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2