7faffbbc90670d57ec7a85b620eb13a4e1117fde0c0a4c12a131105de15a0b40
Classification: Malicious
7faffbbc90670d57ec7a85b620eb13a4e1117fde0c0a4c12a131105de15a0b40 is a malicious file sample. Linked to Xloader malware. Detected by 29 antivirus engines.
Detection summary
- 29 antivirus detections
- 0 IDS alerts
- 2 processes observed
- 0 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Generic Malware |
Hybrid-Analysis |
2024-08-15 13:15:04 |
2026-09-02 14:45:06 |
malicious-activity
|
|
| Formbook |
ThreatFox Abuse.ch |
2024-08-15 18:19:50 |
2024-08-17 18:22:56 |
|
S1207 XLoader
|
| Formbook |
MalwareBazaar Abuse.ch |
2024-08-15 13:04:29 |
2024-08-15 13:04:29 |
malicious-activity
|
S1207 XLoader
|
Tags
windows-server-utility
win.formbook
win.xloader
evasive
Sample information
- Filenames
- 7faffbbc90670d57ec7a85b620eb13a4e1117fde0c0a4c12a131105de15a0b40, PO.TURF.BRB.1408.2024.exe
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- Size
- 1399296 bytes
- MD5
1c38ab057cd891eae6d4531931cd0221- SHA-1
07e878db922a7a1926baee31f15e80972b4e9b4a- SHA-256
7faffbbc90670d57ec7a85b620eb13a4e1117fde0c0a4c12a131105de15a0b40- First indexed
- 2024-08-15 13:04:10
- Last updated
- 2026-09-02 14:45:06
Antivirus detections
| Engine | Detection |
|---|
| Bkav | W32.AIDetectMalware |
| ClamAV | Win.Malware.Silentall-10034109-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| ESET-NOD32 | a variant of Win32/Injector.Autoit.GGB |
| Elastic | malicious (high confidence) |
| FireEye | Generic.mg.1c38ab057cd891ea |
| Fortinet | AutoIt/Agent.APQ!tr |
| Google | Detected |
| Ikarus | Win32.Outbreak |
| Kaspersky | UDS:DangerousObject.Multi.Generic |
| Kingsoft | Win32.Troj.Unknown.a |
| Lionic | Trojan.Win64.Injects.ts93 |
| Malwarebytes | Trojan.Injector.AutoIt |
| MaxSecure | Trojan.Malware.300983.susgen |
| McAfee | Artemis!1C38AB057CD8 |
| McAfeeD | Real Protect-LS!1C38AB057CD8 |
| Microsoft | Trojan:Win32/Leonem |
| Paloalto | generic.ml |
| Sangfor | Trojan.Win32.Save.a |
| Skyhigh | BehavesLike.Win32.TrojanAitInject.tc |
| Sophos | Generic ML PUA (PUA) |
| TrendMicro-HouseCall | TROJ_GEN.F0D1C00HE24 |
| VBA32 | Trojan-Downloader.Autoit.gen |
| Varist | W32/Autoit.APO.gen!Eldorado |
| VirIT | Trojan.Win32.AutoIt_Heur.A |
| ZoneAlarm | UDS:DangerousObject.Multi.Generic |
Process list
| Name | Command line |
|---|
| PO.TURF.BRB.1408.2024.exe | |
| svchost.exe | "C:\PO.TURF.BRB.1408.2024.exe" |