Extracted

• • Target
    68521747022022-pdf.pif
  • Size 292KB
  • SHA256 db097eebc2cb1af575eeb0e7278d466276ddd626cfa0bb5f0b77741679870959
  • MD5 7e1c671cb921a5a53f7b13695889a10f
  • SHA1 94007268dc30fd25c465de624ae8e65197740032
  • SHA512 fdcdc25ee8f5682bd3f519a9cf56c68bebfde7332a312ad05e112418507a95ccd932c4e0b1d2279f5d800765ecec3374b96443278e640927ce4f6241404fb0dd
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderuar3loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2