MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3c1461122de17b3d35baedc41816f3df777c4d5cc67507151a9741b14407aef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3c1461122de17b3d35baedc41816f3df777c4d5cc67507151a9741b14407aef
SHA3-384 hash: 0d5d7bcf85e3fc11939668e1475b878574c43d1affffa8a8fcad19144e271cae12d830163df049ef4f7bca07bd6e9986
SHA1 hash: 58bc38bc1fd77c0facbca6bce38e93cbb6b07d71
MD5 hash: b5c63d5e50869ea2b250d6c1c4aec651
humanhash: august-item-bulldog-green
File name:License_PDF.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:397'312 bytes
First seen:2020-06-22 08:48:18 UTC
Last seen:2020-06-22 09:41:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:TAdighdNHFlds548wL+HLd9BFbDPR8a/JPU92PeQ+lRgEAmg+:Tsoa8TZFN8aJU1lgEAmD
Threatray 5'083 similar samples on MalwareBazaar
TLSH B584CF90BF594A8CD80A57BE0822022812762FDD9955D1CD24FBFDAF7E32F035169A73
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12520/
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.14.30187.12025.UNOFFICIAL
Create hunting rule

Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c3c1461122de17b3d35baedc41816f3df777c4d5cc67507151a9741b14407aef/
Threat name:
ByteCode-MSIL.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-06-22 08:50:04 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ypaumejc3yl3hu23v3oedalphx3xprgvzrtva4krvf2bwfcaplxq._file
Verdict:
malicious
Similar samples:
16de0aa2d02fae6460bb173c9104df4fa758343ab226aea79a3910dce19fa58e
FormBook
52f217cdebe83217297bedc352fac2e475e293e6cad52a1335b3641eeb8c412b
FormBook
64ac97cf73567009fd4ea4707b2c0ac2917c74842a81bddf874889d772bf9146
FormBook
79aeb20e06ed62c3986034328cd3a6a5e08eb617cba4af679112640f786497da
FormBook
8909f47d9db9c66a8ee7b08cf9dad1551e905d48b76f4c3a2acf926c26752ee7
FormBook
8e9f882576a66be70ed5bc204584037087f3bd53d13498126153fb7514f7dd7a
FormBook
9c3dd49a5833197c8ded3093df9fa770129e196acf76de5a54ae3ae3e9580cb8
FormBook
a492b017c3e12fe55493c562ed1304155616cb61b24f6dce0bfcd3eb7a7bdaf5
FormBook
ad8c070c48103dbc11875a052aa0447395f6ddda11e3f9e8aed091f0bb14050d
FormBook
b3b093d992d26b0d21a61a778598abd5dd87649a89f724c2798f60f9dc19de1a
FormBook
+ 5'073 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/200624-kt2qhpvtke/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
System policy modification
Drops file in Program Files directory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Deletes itself
Adds Run entry to policy start application
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

Executable exe c3c1461122de17b3d35baedc41816f3df777c4d5cc67507151a9741b14407aef

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/12520/

Comments