Extracted

• • Target

    65f44440d481fe7d8559a1e4303f4070_JaffaCakes118

  • Size

    445KB

  • MD5

    65f44440d481fe7d8559a1e4303f4070

  • SHA1

    9df52bc586379e05424b4578bb2b76e31627581c

  • SHA256

    9ab3bb93a6d39ab709c9b2369cde749ccbe7f3796c7c3e2fc39aa4715c3bb0fd

  • SHA512

    d24f97fc52beff69bef936c469bb787e1a657dd07a05e1cf6c80ed6c1bd57f0aa63215beed2e7b41d56100655931803c4d87635a831c71c65bdd65689cadac18

  • SSDEEP

    12288:yFda+FdaGCbYQjoiuM3JFyreSP3UNW8jAZnreHTAf:aCbYQjoBM3JQONW80tr

  Score

  10^/10

  xloaderivayloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2