MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77d445a597d3a66104b78fbffd7f90c9a141f42f9c47c7fbef1e4340f1652122. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77d445a597d3a66104b78fbffd7f90c9a141f42f9c47c7fbef1e4340f1652122
SHA3-384 hash: 513339f50cac8f5f2a69bdb396addf53370a137ac632839b8ca86f3e39493485645a25a827a07ee98fb229e40eecf055
SHA1 hash: fe06bd6cafa83defed720c2b76679f23b3f68dd5
MD5 hash: f93b93eb344857843ad3e96c5f50ebab
humanhash: saturn-hamper-tennis-ink
File name:Z15L.doc
Download: download sample
Signature Formbook
Create hunting rule
File size:19'029 bytes
First seen:2020-07-13 08:08:12 UTC
Last seen:Never
File type:Word file doc
MIME type:application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep 384:/imtnBUScjDVFT4YSAXC78OGtcS5AaALPK1pLbiZHLD:/LBLcjDVFT4YW8HtcSSLS1FUrD
TLSH 5982CF71E545323AF7E1807AB4AA02F1F11C4302DB43BAAB6D14F7CE6361E8307C4A85
Reporter abuse_ch
Tags:doc FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mx1.e-tiger.net
Sending IP: 193.23.139.20
From: VIETVU LTD. <polh@tiszakecske.hu>
Reply-To: robwyattonline@hotmail.com
Subject: order Z15L (R901017048)
Attachment: Z15L.doc

FormBook payload URL:
https://magadariable.com/Z15L.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.DOCXRSTRGOOD.WIN32_PROCESS.200408.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.WINMGMTS
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.WIN32_PROCESS.200402.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/77d445a597d3a66104b78fbffd7f90c9a141f42f9c47c7fbef1e4340f1652122/
Threat name:
Script-Macro.Trojan.Powload
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 08:10:06 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o7keljmx2otgcbfxr677274qzgqud5bptrd4p67pdzbub4lfeera._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/200713-lbmhj2emha/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Checks processor information in registry
Office loads VBA resources, possible macro or embedded object present
Drops file in System32 directory
Blacklisted process makes network request
Blacklisted process makes network request
Process spawned unexpected child process
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Word file doc 77d445a597d3a66104b78fbffd7f90c9a141f42f9c47c7fbef1e4340f1652122

(this sample)

Formbook

Executable exe d3e1f5cc557fedb2c060faa7f234f4a09ba408c428e1c2275b2e713e0bf68db7

  
URLhaus
https://urlhaus.abuse.ch/url/412381/
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d3e1f5cc557fedb2c060faa7f234f4a09ba408c428e1c2275b2e713e0bf68db7
  
Dropping
MD5 8201a2b265f439d26d57f1956b82a1fb

Comments