MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00139ffbc60ffd8c46045238f984371a7cd5dd8a9c0f39af10eb0512bb82a40a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00139ffbc60ffd8c46045238f984371a7cd5dd8a9c0f39af10eb0512bb82a40a
SHA3-384 hash: a1ad2686c54776a803bd7f785752dcc454c5e125a722a50e486fdb216ca1a82b270dc7fd36bb5c9bee81e568fc3ebe96
SHA1 hash: 2162c6fa8a2c278b2a6aeea2491ea62eea56e5c4
MD5 hash: 8eb4085101f4cc1f78bde6323c2cf954
humanhash: south-leopard-xray-lithium
File name:PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:945'664 bytes
First seen:2021-06-24 11:46:35 UTC
Last seen:2021-06-25 12:29:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:P503XWDETYjswpV2WtiofINg7nF0p0mQ3h0eCE6ShkpCg30M0FnUueibfKeLYzcD:h0WrAMINOh0ePxkkgEvprrbfXYGKPM
Threatray 6'033 similar samples on MalwareBazaar
TLSH 97158DAD325076DFC867C936C9582C64EAA0B47B930BD243A06315ECEE4D997DF211F2
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe
Verdict:
Malicious activity
Analysis date:
2021-06-24 11:59:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/db60db04-b702-426b-9ba5-b44cd5388732

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/168004/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46534011.18030.30179.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e039ba52-b20e-455e-9609-2802b65506c9
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/807430
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 439842 Sample: PURCHASE CONTRACT #GJPL1202... Startdate: 24/06/2021 Architecture: WINDOWS Score: 100 28 www.merchant-compass.com 2->28 30 www.blueathue.com 2->30 32 2 other IPs or domains 2->32 52 Found malware configuration 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 Antivirus / Scanner detection for submitted sample 2->56 58 10 other signatures 2->58 9 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe 3 2->9         started        13 explorer.exe 2->13         started        signatures3 process4 dnsIp5 26 PURCHASE CONTRACT ... 2021-22PDF.exe.log, ASCII 9->26 dropped 60 Injects a PE file into a foreign processes 9->60 16 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe 9->16         started        36 www.theeasyfile.com 185.27.134.221, 49760, 80 WILDCARD-ASWildcardUKLimitedGB United Kingdom 13->36 38 www.digdeepalways.com 104.237.66.195, 80 ESITEDUS United States 13->38 40 4 other IPs or domains 13->40 62 System process connects to network (likely due to code injection or exploit) 13->62 19 wlanext.exe 12 13->19         started        file6 signatures7 process8 dnsIp9 42 Modifies the context of a thread in another process (thread injection) 16->42 44 Maps a DLL or memory area into another process 16->44 46 Sample uses process hollowing technique 16->46 48 Queues an APC in another process (thread injection) 16->48 34 www.digdeepalways.com 19->34 50 Tries to detect virtualization through RDTSC time measurements 19->50 22 cmd.exe 1 19->22         started        signatures10 process11 process12 24 conhost.exe 22->24         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00139ffbc60ffd8c46045238f984371a7cd5dd8a9c0f39af10eb0512bb82a40a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-23 23:04:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aajz766gb76yyrqeki4ptbbxdj6nlxmktqhttlyq5mcrfo4cuqfa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2c2a99cd33ecf5c40ea8e15227d60b649c6eabbef386444a8a4d8030eb3b8d1b
Formbook
66c88e666d6a8c03122b527176a9ee1b5b9e24a2aa5a49563e242be179760228
Formbook
771e4f69520f71afe6a6e9a4eb4de7dcd8d7521d90db290ca6c27b1a95c532af
Formbook
786e182e324b83c59ad1b095f7d520598a1b72cfce239b4274d462c7ba45bf18
Formbook
94e436107d0fb47e65907647813f1914e8c847f3d6045098e65d1bc56abf280f
Formbook
9998ff1d42d8af0fcc166bea36887eebf182e91d1816853d9f80e6cbbbaf9145
Formbook
bf299d24600936c9f0f4da127632a2a28c4f5243c23a87ee11a6a96b4d7727a2
Formbook
bf6ae876108b5fec915d91bd36d3ccd22c8593be29412521c32a4b3f11a757f0
Formbook
cfc09cd2a2109a174ccbc346779f2e19316be4601173e2e85c3e4314cc139017
Formbook
e713f71dced099e1ed7db81eb22b4e79fb412f08ca0915e8cdebb5b6051aee67
Formbook
+ 6'023 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210624-qkcyg6mbss/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Blocklisted process makes network request
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.xgegqs.com/gscc/
Unpacked files
SH256 hash:
f1f998b267941e8630aac1292c796e2dce046fe5da131e4f31c8b1ba2e5d99ed
MD5 hash:
113184ad05b9cd41dae16120fea4873b
SHA1 hash:
e6f49b8fda293fd0409e05c1425894c50062d7b5
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/5386e53b-ddaf-4160-ba69-1ec76062c53e/
Parent samples :
2c2a99cd33ecf5c40ea8e15227d60b649c6eabbef386444a8a4d8030eb3b8d1b
00139ffbc60ffd8c46045238f984371a7cd5dd8a9c0f39af10eb0512bb82a40a
940049a73f4604611186b3fe1f93bec8328d4ca2c486499d5be25df5b5d51ca9
93eb2094dae2d9f36e52bc880594818e203973d1e62e2b2db76cd39804ff0323
f365c491faaba01943e7ab894d34fccacbb9d2e8b9bcbe9f6eaf0e47aa420329
14e50f20e1ade011dc7a2bb7dff021e709f5c8b9cd231b443375be8f73dd855d
8bbb9864358edcc07b2d9ca257e14daa091353fc4f89c8f2b45bf745a9efb4fb
22bb6e04e78a2c4e5620e588228a99653abdff1925dff84e4da22428b61d9c44
2239e9738b2618a22115aa25c1016a01ffabd0bfe9a405f3b87cfb5cd9f42458
SH256 hash:
325794236fc91f8cce78f0af71b5809eefe1e791fee10de892f269e49ec00c67
MD5 hash:
22b47b78c49636012c711b76bf38616a
SHA1 hash:
87127c1d12332933872fa98e6e68471b1342f600
Link:
https://www.unpac.me/results/5386e53b-ddaf-4160-ba69-1ec76062c53e/
SH256 hash:
06306e33b7e10429759ab8c42e31e9eb8edbd76c4f1a792a5c231a57876ea338
MD5 hash:
5bdd03077864d32db51b085294859f68
SHA1 hash:
70392a93a4c8be2377915fd6e6d3e7a3a9600adf
Link:
https://www.unpac.me/results/5386e53b-ddaf-4160-ba69-1ec76062c53e/
SH256 hash:
00139ffbc60ffd8c46045238f984371a7cd5dd8a9c0f39af10eb0512bb82a40a
MD5 hash:
8eb4085101f4cc1f78bde6323c2cf954
SHA1 hash:
2162c6fa8a2c278b2a6aeea2491ea62eea56e5c4
Link:
https://www.unpac.me/results/5386e53b-ddaf-4160-ba69-1ec76062c53e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/00139ffbc60ffd8c46045238f984371a7cd5dd8a9c0f39af10eb0512bb82a40a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/168004/

Comments