Extracted

• • Target

    JaffaCakes118_cc19c69f756ab25010c68a64b03f2eee

  • Size

    254KB

  • MD5

    cc19c69f756ab25010c68a64b03f2eee

  • SHA1

    48e28f2fcb7a13efa879b99b14ba52571b6e5224

  • SHA256

    ac4a0328d512526f20122f0399d557b1334f3b2ac264d9e749d6d2788e956b2e

  • SHA512

    6a0caa9934e2c4366e312be5b6ce60e0d3ffb715ee6d97eaf13dc4cd485d305e2972868624e4460b5076ff0eec1a94ba20199f2502ab290a584b0705ff12d762

  • SSDEEP

    6144:wBlL/crEZe0DNzwg7f7qKvWghBaJ4JCe/IVtg7MxY0bJv0T:CerEZbDug7zqitwI/Ug7VsE

  Score

  10^/10

  xloaderepz2discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/skjesair.dll

  • Size

    38KB

  • MD5

    f9099ad46c16a20b52f173f5806426bf

  • SHA1

    b7543e7af6930e16520f41bc0c3e5fdd5f1ce45d

  • SHA256

    e80f972bce5004dfe27ca8a8063f354be8b0b618119db1e706242d28217e02ca

  • SHA512

    6d6c2aec061cdc3e34b7774e1a16971f246b79da659bc8140d0965130a54bf81f57ad50d56314b5b5f551eb1d24e15d2d6131e041665dc3ecb921af3a426cdc1

  • SSDEEP

    768:JbqF9FSKFaJ7arlVhknrYOyW5XX+Jv+1:kLF5Hk3O41

  Score

  10^/10

  xloaderepz2discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4