Extracted

• • Target

    827615424_PDF.exe

  • Size

    300.0MB

  • MD5

    0e20fe4a6b6ae6a93129d7767dab8558

  • SHA1

    ffb19496edae93f3981ab744b0688b881339e3ac

  • SHA256

    ed1babfb5993b76abda6deb0a715042923634b42d2eedc06eaa01b56e06fe100

  • SHA512

    070c95a4e846c82628b3a7a0044bcc9f6360ae4c1fe2fc777c887a43c44f30514af323d693b05c591cd367efd4622b3d36b76f18a53b3d3609ee80cb1913688a

  • SSDEEP

    49152:Vnm4UcmDYIbFaTI39LMK44bFh1DgtJaJk4UUUUUJUUUUUU:x6blbku9Le4bFhuO1UUUUUJUUUUUU

  Score

  10^/10

  bitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2