MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 003e445ec7e3a973ac6b61b8375e4db13e9ac69a2fb48f3c647571c473eb22c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 16

Intelligence 16 IOCs YARA 16 File information Comments

SHA256 hash:	003e445ec7e3a973ac6b61b8375e4db13e9ac69a2fb48f3c647571c473eb22c2
SHA3-384 hash:	b16b9a9de72d705a377121b2dd5213971360dcf176f7186674e466233cd6eb854a1765c14699a835c102ecea4f585a6a
SHA1 hash:	b4e6f18ac33bda5b7fb34018c2201b515b3b6767
MD5 hash:	d397a6f50193af8aed6103814f0da716
humanhash:	ten-minnesota-spaghetti-tennis
File name:	9098732783728.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	775'680 bytes
First seen:	2025-02-04 22:16:25 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:HA9wecl9wdVYU63g6HxeHyxQc2SHgBUdKnriWWG4Kx4aL1cL6hcRNLn:OwexdVY9Q6H8yxQc2MIUExWeWZUczLn
Threatray	45 similar samples on MalwareBazaar
TLSH	T15FF4BEC43625AB06DC3A57F18624ECB013F91C68B520F6D61EDA37DB79697028E18F1B
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
File icon (PE):
dhash icon	0999908fc78787fb (14 x Formbook, 3 x AgentTesla, 2 x SnakeKeylogger)
Reporter	James_inthe_box
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

521

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

9098732783728.exe

Verdict:

No threats detected

Analysis date:

2025-02-04 22:17:59 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/8023cb2a-f578-43ba-9213-04fe7ce3da65

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Malware.Banload-6981577-0

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a2932251193558eb196281

Tags:

virus

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a window

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated obfuscated packed packed packer_detected vbnet

Link:

https://www.filescan.io/uploads/67a291e9e7790b912a1e0c49/reports/9261b43e-6554-4f30-bb90-d32f39f25304/overview

Verdict:

Malicious

Labled as:

IL:Trojan.MSILZilla

Link:

https://www.hybrid-analysis.com/sample/003e445ec7e3a973ac6b61b8375e4db13e9ac69a2fb48f3c647571c473eb22c2

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/254da746-3a29-4359-ae56-f2bb3f5bdd65

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1606886

Signature

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Joe Sandbox ML detected suspicious sample

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/003e445ec7e3a973ac6b61b8375e4db13e9ac69a2fb48f3c647571c473eb22c2

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/003e445ec7e3a973ac6b61b8375e4db13e9ac69a2fb48f3c647571c473eb22c2/

Threat name:

ByteCode-MSIL.Backdoor.FormBook

Status:

Malicious

First seen:

2025-02-04 14:47:06 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 38 (68.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=aa7eixwh4ouxhldlmg4doxsnwe7jvru2f62i6pdeovy4i47lelba._file

Verdict:

malicious

Label(s):

formbook

unknown_loader_037

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:3nop discovery execution rat spyware stealer trojan

Link:

https://tria.ge/reports/250204-17dl3svne1/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Formbook payload

Formbook

Formbook family

Verdict:

Malicious

Tags:

Win.Malware.Banload-6981577-0

YARA:

n/a

Link:

https://app.threat.zone/submission/3eb2290b-7ecb-4b6a-b762-f244dbc759dd

Unpacked files

SH256 hash:

003e445ec7e3a973ac6b61b8375e4db13e9ac69a2fb48f3c647571c473eb22c2

MD5 hash:

d397a6f50193af8aed6103814f0da716

SHA1 hash:

b4e6f18ac33bda5b7fb34018c2201b515b3b6767

Link:

https://www.unpac.me/results/4ccbcff4-ea1e-48b1-b020-5993baa915d2/

SH256 hash:

27e61b24207defc81b09beaa0dc49159a95e6d2b3b85a2515ec57f03f9124840

MD5 hash:

ed31a027c1923534c634b5985005451c

SHA1 hash:

44ef61d23f33f196f2bde274dd03fbb7cf9527b2

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/4ccbcff4-ea1e-48b1-b020-5993baa915d2/

SH256 hash:

3e29096cee6761c66742552b7f65e06b90ba5a957bd8d1d18c47b6cd88c2208c

MD5 hash:

b91cf520b386cb419ea16de24f2ea39b

SHA1 hash:

664c3929a780654f07ecf2e9cae2d0fdb29e49d8

Link:

https://www.unpac.me/results/4ccbcff4-ea1e-48b1-b020-5993baa915d2/

SH256 hash:

74622d50375099d2ce3d8fbd857bd6163ae1083b3b4ab243b9e9c0681f0b6d2c

MD5 hash:

9dd3d8c66e9517f1395e528e9caacba1

SHA1 hash:

1d7cffd8ce762d6bd77719ca1b0d272b7d47d49c

Detections:

win_formbook_w0

win_formbook_g0

win_formbook_auto

FormBook

Windows_Trojan_Formbook

Formbook

Link:

https://www.unpac.me/results/4ccbcff4-ea1e-48b1-b020-5993baa915d2/

Parent samples :

51d5fbecdf7459fc37ab296b97245a020f31cfd4ac1073f3fb2947a3710a8523
9bf5d73a9924bd9e616336e200767e575569869d7d0ab959de9c7ebb37914dfc
2040a0fdd0eddf11176cddce8489b0906e9bb6ed39b2c825f883e26a3309db57
4336ddb80f3875340305306f98bd57efcb38a2182153d71308957167a295c070
36b2c227683d3aea101fb59edb33edb1ba28ec0753a32a5ce42b1959d6716965
d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d
003e445ec7e3a973ac6b61b8375e4db13e9ac69a2fb48f3c647571c473eb22c2
9d81ffafe26b6cf9e8c5fb0ff739c279d07c6d96b7f1f3927741e7cb6746b452
be8ae15279781ab2ac7f6985d5d611d6533fdeb2be8d783eebccc28e38ab256d
bb69c9e4dc8bbcb1e7c4d7fe8bcc86c87cdb4af34212b992a5ac82ca8e92782d
b1d422db723db6c2f7293a2c09397b46677407aaea878d24c63b0911edd0c6d0
7df9ceec9c6ece56d60b5264804b0c9360c4f87bc595d9987c5d87990511ba34
f2042d162f33fa6527abd2dc4e593a6f89215f903b6a4afe9b57da3f6da7c6d4
20e542ae3966472a40baa9e22ee751b54547961e6b5b43d23040342625685193
d6ffa7c046b2e2d6268f0e516170f77c2f1aad8fbfa1feba5be0f4fe7963aced
94cabb62a68074520220fe485bf718bb4ff66b76ff39037542845d2f143e35ce
ea4fe51e13f6ab1785535b32345f69ef110e21981bf7dbb09ce02c0bdec1e43c

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/003e445ec7e3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/003e445ec7e3a973ac6b61b8375e4db13e9ac69a2fb48f3c647571c473eb22c2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_DIFF_Common_Strings_01 Create hunting rule
Author:	schmidtsz
Description:	Identify partial Agent Tesla strings

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

exe 003e445ec7e3a973ac6b61b8375e4db13e9ac69a2fb48f3c647571c473eb22c2

(this sample)

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample