Extracted

• • Target
    97236-71303032022-pdf.pif
  • Size 333KB
  • SHA256 52497f0956bd4d1e6467e37ed7d62a26844bada17eebfa05422d1eaacb0b3899
  • MD5 cae9e90647fbc6fd8bd3123aadc9fcb9
  • SHA1 2514eb90cefd1b6caf6cda4ea652f86ef67a4538
  • SHA512 537f2940a1420750623259bdf6ed39b7113ab4dda5d1daec68ed1765fc72b8a1c726109f61727f3c6f406d501bad39e3640abc50c749c5396ff637eff1c1e77f
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadernqs9loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2