Extracted

• • Target

    873_93_517_PDF.exe

  • Size

    23KB

  • MD5

    bf1cd9a3b9f4e67ccfd3a2a1e2942c0c

  • SHA1

    fb5249b0a315531d94bf4e73d2b9902b8a39e63f

  • SHA256

    6ed2e7b85f9591e922a95dbc167e5ed3ca2da2d3b823ed14aadc3eecdbddd5f0

  • SHA512

    5e219a2d85b36080a49079a97eb6aa4c5a4dc3290f0ed3e67134824b622d29fe72c3e58f8a2c6c41471d7c198250a29c101a6792eba628483a0052bfdf074cc7

  • SSDEEP

    384:+2HMdudOHoRir1G/gJ6jX4hy7cySdI5P9mei8MwU/iUx8VWDCvqhms3h2wappTut:+20v/xDDuwkuedmdVKBDhpA3T+RPvjG

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1