Extracted

• • Target
    Request For Quotation GM-0034.pdf.exe
  • Size 806KB
  • SHA256 1cfe87811d0c330dd6fdca569e2c0139fe747ce6ed286a6b1967211da83aea9e
  • MD5 9b04049db7fa11306845b50bdae4db75
  • SHA1 610ae0aaf8207aaa5f53c9f6c590c93236d74f2e
  • SHA512 fcd5f96a9c65ac946d444f19331c40dfd88a2561f3ae15dbdfe4e1bd95bf4ecd21c2c28cfe064d25aec2b482c218c3bd2dea54d60327899d1eb34bc15fa803ed
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadercnt4loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2