Extracted

• • Target

    Request for quotation.pdf.exe

  • Size

    1.1MB

  • MD5

    5fbc756d04b68cd1c66a12a56628744f

  • SHA1

    174afc1c59dd513d93afb9aa414e4a3486e8d7d2

  • SHA256

    069facb5cf9660abced4bcb48a98ab7e5e51bb311517148ec794ff6ae4985652

  • SHA512

    cb351a7675035f3e487a0d1deda13e4eb44ee74759e29d6cb4b43a990bc337afd15a5342ed543a5abb8324939ab707d347c43db7b140472529a57a9ac162b863

  • SSDEEP

    24576:AAHnh+eWsN3skA4RV1Hom2KXFmIal9tlBu0OYACQ5:3h+ZkldoPK1Xal/juPP

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2