Extracted

• • Target

    PDF_Scan-AWB#5305323204640.exe

  • Size

    1.6MB

  • MD5

    fbd0913a7ff1c25f30509841f784ba06

  • SHA1

    65384b25ec04d910d2f1dea75692477a9e95d645

  • SHA256

    823cba52fb307afbd762ff01b52ca62586a126065f2a914c5e6b1ce3c203ba8e

  • SHA512

    ea4b1cc7b45e78982146a84f2d10b118d51957ad0966b6248225aab0b39f5ac17aa3a055c79d677b6182b38239dfe297c76514d676aa2a2094b4bce029ef8901

  • SSDEEP

    24576:Qx6i0dzjqYeiktfhv1X9eL3xQv7towhrDj:QA3dyBtfhNX9ejxQv7Lvj

  Score

  10^/10

  xloaderuuv8defense_evasiondiscoveryevasionloaderprivilege_escalationrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Xloader payload

    rat

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2