Extracted

• • Target

    Original BL Invoice & Packing List pdf.exe

  • Size

    1.2MB

  • MD5

    32edc7a227ce30813c73756c2fdc90cd

  • SHA1

    bcf54c69b988f72a819f15692f53f5eb839a4be7

  • SHA256

    3f88232fbf581d4a628de3b80c624fdabea29d159917ef596fe13b2f49f8268e

  • SHA512

    c97da96cd175f107538eae3a7eef076b24faf69721ab52a2d01b0a5b2c67f3140c2b8eef48d51a4b74334eac8f678116102705aff66cc127eef8c82693a9f989

  • SSDEEP

    24576:aYNkCmS4OsBgo0q4wMZa3mK/vfW+t3leBsAU8:aEZoHMZa2K3P1eB

  Score

  10^/10

  xloaderc3scdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2