Extracted

• • Target

    1bd2c04eca08ef48cfe2b9860d5d12a7_JaffaCakes118

  • Size

    818KB

  • MD5

    1bd2c04eca08ef48cfe2b9860d5d12a7

  • SHA1

    dffd6174716cce65fb113c228a30adfcebe6f57f

  • SHA256

    cde3eddb48864869869b8a59c81843b8e4fc1243170ff598ec92e28a5d7c8b2e

  • SHA512

    72e78fe2d3b50f1336e0a5e0c03060ff987c6db88e10877fbbf1f9d9bf58e2b9233a904f7f4d56763bf3b0952cf10fbff82620204ae77d645becaa967fd46dc8

  • SSDEEP

    12288:A3JR/HK7zVNr2NSo4X7lJwmcFhKlQbWDUwiFTIqpVFeGOh80kh4ypuL6yqd6ZesL:YqZNKNiXnwz0lQbWDmlVFYhxM

  Score

  10^/10

  xloaderp2iodiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2