MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b4dc733949d65f6a058326f41ce6281f9ac85a351c094363394fe95450336d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

FormBook

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	7b4dc733949d65f6a058326f41ce6281f9ac85a351c094363394fe95450336d2
SHA3-384 hash:	df234d69cf5bdd1da5a3d089f1690ef2415669cf8035c9d5080fba317359a9d0be7180879506b3b975ea4bd1ee37a118
SHA1 hash:	459c5ddf880fb114dea7f99d9a4767d5deacbc99
MD5 hash:	605be1171521a97a0732bae5e9d0e2ea
humanhash:	hamper-sixteen-equal-jupiter
File name:	OrderList.pif
Download:	download sample
Signature	FormBook Create hunting rule
File size:	320'512 bytes
First seen:	2020-05-20 12:01:32 UTC
Last seen:	2020-05-20 13:17:40 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	411c5e716fd6a117f422ca0644ec0c25 (1 x FormBook)
ssdeep	6144:JWCw7cQerWt1SPTBhAhxsJ31TApiZAMXDzdkS:Jb61tYPTBhZJhpRzzdk
Threatray	2'202 similar samples on MalwareBazaar
TLSH	77649D21A51C8EA8D53F90763AD3DDA69ECE8CB3516E0C6AD438F701E53E682C497137
Reporter	abuse_ch
Tags:	FormBook pif

abuse_ch

Malspam distributing FormBook:

HELO: smtp.srnet.lv
Sending IP: 94.101.230.23
From: David Lorber <building@constructgroup.sk>
Subject: Purchase Request
Attachment: OrderList.zip (contains "OrderList.pif")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

Gathering data

Threat name:

Win32.Trojan.Noon

Status:

Malicious

First seen:

2020-05-20 10:48:02 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 31 (80.65%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=png4om4utvs7nicygjxudttcqh42zbndkhajinrtst7jkridg3ja._file

Verdict:

malicious

FormBook

474cad642b1cf88f8d7f922cbfd9b8a00d7fc0eb40cafc0877007ee2884f105f

FormBook

6f95416c1006a499c7012c6cde49a27f83223c665cf9b28764030afeb04bf697

FormBook

7050254375f80a115a4a4a497bd423bcedd3b5bf2dcd8aceca58376cbc6b23a2

FormBook

8913dfdcb2c32518af2ed1836daac8559bd5b62c2fe2461463c49a5275bea4de

FormBook

9b7aafdd3549d2f40208d8cbf57b3763d033bfe15a31541a3ca7329e7c2d61d6

FormBook

d2a6e56b5ef7724907cceaf6ceb9da2a31012988169b8612248fd3b299e3d821

FormBook

e13acda03eb4829793beb5c0664d5752663b7ef5ae72b63724e7eaf189a9fec4

FormBook

e6d371badc121f232f4305f3a50f0a136d1b7edbc3337414ca692c26ae41986c

FormBook

e86fd29446566f02088cc93deb2449d5aa7febf4ced0a41d36095520737f0338

FormBook

+ 2'192 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook rat spyware stealer trojan

Link:

https://tria.ge/reports/201109-2r1nvh84kn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

Drops file in Program Files directory

Suspicious use of SetThreadContext

Deletes itself

Formbook Payload

Formbook

Malware Config

C2 Extraction:

http://www.tromagy.com/dl7/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.