Extracted

• • Target

    PO#8329837372938383839238PDF.exe

  • Size

    177KB

  • MD5

    ba88dca6e9d0a6f55a8addc30b02d988

  • SHA1

    f48b8d8255a9192675dde74ef7db412fcb528792

  • SHA256

    b15e57df1ab1fc902337d52f633267b802ccee6f37ba21ca065ae14380817081

  • SHA512

    f10c077bb1aa2c0c32ce0dc03a0b3e27f838b98c1251d7540d2d81e7c3b13ee45cfcb79be085ea83dd12ee9eb0613a1fc116f9283236379fdf85320199a6e2c3

  • SSDEEP

    3072:jvXdvpzRm9npGJyJObSGOOs3KI/ZMQRoGaHn2J:jvXdvpzRmzm/bSGOOs3KI/GQI

  Score

  10^/10

  discoveryxwormrattrojan

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2