Extracted

• • Target

    Shipping Document PL&BL Draft.exe

  • Size

    556KB

  • MD5

    b2238c351ed41a67f444ea0c119d957d

  • SHA1

    30f944d175c5075240d84662a5b0b3f7ddfbd85f

  • SHA256

    f46c3e1152437fbff901cad6cf094298b5e1578a15d204993d715a936e7f501c

  • SHA512

    ad67d394f57adc6ec625be5c2f1a678b7a4a247346ea1d7f2e4558bbe23d2c7fff65d1429cc85429661532a45ad90670732149f968ed657629974e7c75b3df1a

  • SSDEEP

    12288:FLDMAzjN4YEAFJmOZ76FpC1PTewf//dC:5UOlopoKw3

  Score

  10^/10

  xloaderc8eoagilenetdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Deletes itself

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2