MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f14d7b35ccb962517c7657f064f0259f4fef55c53c77bfebc8ee360f642b7842. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f14d7b35ccb962517c7657f064f0259f4fef55c53c77bfebc8ee360f642b7842
SHA3-384 hash: 72cc61b786199c01e4b1155f74da7faf5c0f39bc3f6fd42bc4dc85080165ce0af1292510fad84024f429e11ad3521da8
SHA1 hash: 3ca94b74cc14a506f385fa7b633883c3a79d1de8
MD5 hash: 45fee64a3a96f7832d7351ccbf990299
humanhash: purple-march-dakota-jig
File name:orderquantity0030502020.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:912'272 bytes
First seen:2020-05-04 17:41:19 UTC
Last seen:2020-05-05 10:43:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d8229d3fd67422e902e922fed93a7eb1 (3 x FormBook)
ssdeep 24576:Zrnwr5cPySMn0petFdfXbPqfV8ZqkOAE9c:Vnw9chMnWQFdf02E9c
Threatray 5'114 similar samples on MalwareBazaar
TLSH 85159F95F14885DFF92B1DB3A83BAA302096BEED90F1D24D295E772545B334200AFE1D
Reporter abuse_ch
Tags:exe FormBook

Code Signing Certificate

Organisation:VeriSign Time Stamping Services Signer - G2
Issuer:VeriSign Time Stamping Services CA
Algorithm:sha1WithRSAEncryption
Valid from:Jun 15 00:00:00 2007 GMT
Valid to:Jun 14 23:59:59 2012 GMT
Serial number: 3825D7FAF861AF9EF490E726B5D65AD5
Intelligence: 44 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 8815DFF787F21FA8106760CB89C5B4493F4BD45E2CE801D2A4FE1F61DEE0C039
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: smtp.safemail.it
Sending IP: 147.123.1.124
From: Andre Lategan <hari@havconstruction.com.sg>
Subject: orderquantity0030502020
Attachment: orderquantity0030502020.exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.44200.18336.2779.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 16:56:30 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6fgxwnomxfrfc7dwk7ygj4bft5h66vofhr33726i5y3a6zblpbba._file
Verdict:
malicious
Similar samples:
157ef05047452109ec1552af00806f1469254bc14a5cc942e41180ee82d508a7
FormBook
30bbf2043054b92e495bbd55f67e43b8eafce430bf31d8aaa4899385e503cdbe
FormBook
3527457b184139953c43be59287281eb8f797e9cc8f3e9d637362276fe4f83a2
FormBook
58f28dd7cc2c257f5ac8dec9111d8cf8942e1cf62bb8334f4922e4b124d4eab9
FormBook
6f4b543bdd425e2cb35fcc06f79dfac486985ae0d84133c34e0fd01b3a2c22bb
FormBook
703340ccade47686ffd64ad3bda9829f0b1d8b704101c5f5dc2b66edcf01dfa6
FormBook
99d9cdc246bf28881b009ae71b1611c83397b23b5adf5b3746f51a5a2903ec24
FormBook
c28628e453851e95098e1706bb1d130a863b70abd4b5c316ea710f83ef68b0a1
FormBook
cf5a86737ab13ec2ea858e0d7c635c3a3c79d1deda05e79a81dd1b470dcb0942
FormBook
e8d41df74484529065bad33443225cf40b05423b7cd4b0af478043c13394750e
FormBook
+ 5'104 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-3gedlbfbfa/
Behaviour
Gathers network information
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of web browsers
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.mansiobok.info/ch09/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

Executable exe f14d7b35ccb962517c7657f064f0259f4fef55c53c77bfebc8ee360f642b7842

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments