MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31d1428b910df6a6b0bc62b597f5c4c88514cba2ecd8c8fd28410ab97952b7cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31d1428b910df6a6b0bc62b597f5c4c88514cba2ecd8c8fd28410ab97952b7cc
SHA3-384 hash: 622809dd76476371a718a63b20b788c0ec8e856de3b7e024cbfa29721422b66a8ed0625eb6baf3e02f7d9970a92911dd
SHA1 hash: 9684cdeec3c8afb7166d9ef09e1a50690a90d3bf
MD5 hash: 54927f03f5647a4b662837bdede5166b
humanhash: uncle-quebec-wolfram-mike
File name:ORDER_8431.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:364'032 bytes
First seen:2020-04-30 09:52:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:Vx14EBHRz9Rz1IBD+1otsaXENR/AHBvLU/wiIuswn5lruT3MpxIRztquUhjEBXqH:Vx1ddT1IRQO1phT+3nE3ftqDjEBasC
Threatray 5'130 similar samples on MalwareBazaar
TLSH 7C74E0537799884BCE990AF44C12A20407799F59B85BF7CE6D8532FE0BF27D0790A683
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: qualitech-solutions.cam
Sending IP: 111.90.140.145
From: Gary Stein <g.stein@qualitech-solutions.cam>
Subject: RE: RE: URGENT ORDER
Attachment: ORDER_8431.rar (contains "ORDER_8431.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 04:58:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ghiufc4rbx3knmf4mk2zp5oezccrjs5c5tmmr7jiiefls6ksw7ga._file
Verdict:
malicious
Similar samples:
1feab92e184b7440b336c41a703beb4fa4be5cdca014c8b7ac5cfa6b408eb2a7
FormBook
27379cbd39dae5d145ff292ffd71387a5508bba83997177272742b486cb4e662
FormBook
6012fb54cc0a67842710e7189ebfa42c27d30f18a604fbb4122734fb23b7accd
FormBook
7f30518d5d377a5daabfdf24a509e35c46b04f951500fec7a78e84724c4cdbc4
FormBook
accddeb954844341b87c006344f21c50757cd228d2f071d39e8707209b1a49f9
FormBook
ba9fbfd1eecd1879588201af8b4498bcef57e8950286170dbb0c7c5b7ded6a17
FormBook
ca6c6262134182f4bc6367855eaf6a390bf9f3a1b95e7238f3480dfe8baf50db
FormBook
e3f68e3679fc2ab587e712ce137e107318ebaa6bd5e724a76200bb10c945312b
FormBook
e75e9eb97fb635737341ed9fcfd25471fdd9889e75305bbb6b32bbee19b32d52
FormBook
f34f4e3d8e9c1ec1d066d75d07f3d93c70931d6a54d736dc12f83b8277db2557
FormBook
+ 5'120 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_nymaim_g0
Create hunting rule
Author:mak, msm, CERT.pl

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 53440a1eab20033b5567d4c6582b0ab159fee1193dde09e7a3ac5d35c61a94c4

FormBook

Executable exe 31d1428b910df6a6b0bc62b597f5c4c88514cba2ecd8c8fd28410ab97952b7cc

(this sample)

  
Dropped by
MD5 a3b2837e01674ca8ad342c96bafa9f46
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 53440a1eab20033b5567d4c6582b0ab159fee1193dde09e7a3ac5d35c61a94c4

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments