MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2867fc0da53d97c9ad3291cffd683c48417f47431b36e2101c11a29ee3ae1e87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2867fc0da53d97c9ad3291cffd683c48417f47431b36e2101c11a29ee3ae1e87
SHA3-384 hash: b34080ba49be6d5abe2275f154c148368bfe53471d5c212b10508df0221fe4692938d17058b506f659432be5b6dcd70c
SHA1 hash: 1dd77fa99939dcf73564424b30d289718d0d0948
MD5 hash: 2d2d623fec2f7f71dd31fe99c8a3ac66
humanhash: leopard-cardinal-uncle-uncle
File name:Product_Inquiry_List,pdf.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:403'456 bytes
First seen:2020-07-06 06:35:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:kdrMnuG7i+n3HAApBz+HVlomP7JZIq/WHN3gpohRvb3ohYKsnwUK9d1l2h6Se:CwnxPn3VkH3+H5eCvb3oh/Pue
Threatray 5'262 similar samples on MalwareBazaar
TLSH 3584D0330756FED6D73D4E74C29027801E6964277B60DD48BDC822DD626ABC4AE78A33
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
147
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/20831/
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Launching a process
Launching cmd.exe command interpreter
Possible injection to a system process
Unauthorized injection to a system process
Deleting of the original file
Unauthorized injection to a browser process
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2867fc0da53d97c9ad3291cffd683c48417f47431b36e2101c11a29ee3ae1e87/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 06:37:06 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fbt7ydnfhwl4tljsshh722b4jbax6r2ddm3oeea4cgrj5y5od2dq._file
Verdict:
malicious
Similar samples:
14ab9ac5f254705d24bf42ac212827c4aebe6f64ba3a9331c8c153bd18195152
FormBook
1800678ba5a47f5492bd8ba441fc37c2119bf057f0856b5d32a6b066f2ae5c27
FormBook
3f180fe3f695de063f953d0c48408aceabbca729b3faa7316926c69650a5f8a4
FormBook
590fde182a154cd89b15d88546d60351b9fecb51e04fbbf4affd8d49a618bd23
FormBook
6f95416c1006a499c7012c6cde49a27f83223c665cf9b28764030afeb04bf697
FormBook
97d0665cd19b89fabb2a9220c19b88776693c6bcc7d2159c10e18cf3707bb019
FormBook
9b2c6f08cd9a4e3b144422de4d540290542ce50239f2c85697a036a461b25264
FormBook
c7544c2d4180660fc3a96f3b66b5caa0e168dcfbb35a870f1c576a152ed62348
FormBook
e13acda03eb4829793beb5c0664d5752663b7ef5ae72b63724e7eaf189a9fec4
FormBook
e273d82c782a01c388cc619e6832bfb43301f4308884751b9393262302fc84c0
FormBook
+ 5'252 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/200706-5t3emtg6na/
Behaviour
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Drops file in Program Files directory
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Adds Run entry to start application
Deletes itself
Reads user/profile data of web browsers
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

Executable exe 2867fc0da53d97c9ad3291cffd683c48417f47431b36e2101c11a29ee3ae1e87

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/20831/

Comments