Extracted

• • Target

    RFQ_AP65425652_032421 urgentes,pdf.exe

  • Size

    834KB

  • MD5

    6324862ccd183522472fedbe3901d267

  • SHA1

    46b1718671e662b34d903eb9acf2cc09ef893ff6

  • SHA256

    1da66787bac6e2293792bf1f2d262c9d587b1fb63084ec6afff294b79c208014

  • SHA512

    e69e3ef927121ba5c89270a2d7a1ce0f5b367ddac4fc7f3aecb32b47722083d3aa437995d7766f99138f172f30b628cc806f786b916a897bff3145db8c6943df

  • SSDEEP

    24576:IehAesJPxtoGyiI7bMQVtbl1wm9YL44Mwv5N:IehAe0toGqbMQVtbl1wmuc4H

  Score

  10^/10

  xloaderpe0rdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2