Extracted

• • Target
    Order-EM5148932-pdf.pif
  • Size 319KB
  • SHA256 ea1c7db69290a2b343646ede684b58ed96e891feab6dadbbc9909c1c245d4bf2
  • MD5 68606139ca13cd2a5f1a5835fed4cb1a
  • SHA1 9d0a1485aa82bf9cc7fbfd2854d517244550a342
  • SHA512 d26d47c3da27ba7448f0df86770bfe1d5aa959d244e9b6dfa1a5d923f7b9d41b0fb00491bb9e6e55e376f1d76006e2d7f9195d0ed34c16a614d8fb1a8a3f6f5f
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadernqs9loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2