Extracted

• • Target

    orden pdf.exe.xz

  • Size

    408KB

  • MD5

    cea94c87fe3c1306a76559d5a386dba8

  • SHA1

    be8becb10dd3d396e66e77384e640f5354def4bc

  • SHA256

    ec50cfdb5cf346d08a2c4c75715835ea1fc2ebedccc07dd80288fcf5472bdc88

  • SHA512

    9243100980a75d609b918f0fae63ad3909c7192f0290726647fefef18d839421981f4e4e91d3a336c7fd6d5aa1d9eaaca31cd1d98d682c75e37a70e1ccffc255

  • SSDEEP

    6144:mttGNYSl7foYhQmeOZTb7KXBnVDLHbx7W5dvedaVJM4E+llwbiqQRw74lOGBGFM:mtoNYSl7f3Q4ZWBVnTda0H+sPcUyIC

  Score

  3^/10
  behavioral1behavioral2

• • Target

    orden pdf.exe

  • Size

    992KB

  • MD5

    567514749532f410dc6c1c2edb544218

  • SHA1

    8d343ddf387a9c8ad878e203bbcfefaeb3a1b66d

  • SHA256

    7c9d431fdecc3270f72b5345965482158292f5072e4e6a4ba188634126681e29

  • SHA512

    b2c3234ea1eafeb16c6ae9102c1fe8c6a5e4d02cd02e15d0910fe2fa5e151f2546217e73225988e3bc5dba53acb93190f4ed6ce1e500c2f08ef94e3cf98f41bc

  • SSDEEP

    24576:87Je3RHKC7+5fxxViZhPYpnSZqAEuoLI9:8sqvCASkAEuoLM

  Score

  10^/10

  modiloadertrojanformbookges9persistenceratspywarestealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook payload

    rat

  • ModiLoader Second Stage

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral3behavioral4