Extracted

• • Target

    6256453ccc02f406d675a15038d6ea98_JaffaCakes118

  • Size

    2.4MB

  • MD5

    6256453ccc02f406d675a15038d6ea98

  • SHA1

    8cf5f95ecf8cd58dcea48e320953de54b2004bdc

  • SHA256

    9681746b0d72e882c0949fcbdd3005b15720d66b4a8795b9d7c8c98a59048582

  • SHA512

    4b01b13a9ba2f6167fada9a44936132783adb0fd9b50d9fc922cc6486ea20f9071ab75c38c1205079956c8ad6b55ffd7a64e82efff73684c065948f0032ee437

  • SSDEEP

    49152:CqoZ0ajbQzlq5O+l4QOnn8jeX+l8uvlhfNf5lWLPNyeL9+hw/USGy7Xk/51HwgGF:AX0zlC6m4985m0sQ1a7

  Score

  10^/10

  xloaderivayloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2