Extracted

• • Target

    Craig_Group_Quotation,pdf.exe

  • Size

    1.1MB

  • MD5

    a885699fd3e6da80b574541565df717e

  • SHA1

    fa98d786dd5ec70400573dde7301ac6c6eb8e720

  • SHA256

    7541f828539e1c7ddccbb3c581886958b16c8016675ac2fb2dd9998bd1dc1161

  • SHA512

    9711111833a07fe9f4366b928ce3c1cd9d7eee270129972a0260864432214c931c7356bcb0d874701407f812b0a64e0254f4a74d96ac4900e3f971156989b83d

  • SSDEEP

    24576:QTOxcq/gHU5/d3dK64J5IHuH4oJiA+wneFl4MxgalS:QTOxpK64JyOYoEX4MOX

  Score

  10^/10

  xloaderrqe8discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2