MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 009ba20b8c436d6b47e991e7a7f5afa3999f34096b3ee207fed916ab53af7c9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 009ba20b8c436d6b47e991e7a7f5afa3999f34096b3ee207fed916ab53af7c9b
SHA3-384 hash: 1d4f22a09ebda13d005c079606187971776d90c5348c62a117f54f1a791ae3486341176aa833e11ff0a30d0d4b468844
SHA1 hash: 9eaa869bc49a2282ef813d725b0238aca322af26
MD5 hash: 69c8862e58dcc753cc52e3f73e36f78c
humanhash: xray-massachusetts-minnesota-maine
File name:DHL Invoice.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'177'088 bytes
First seen:2025-02-01 15:42:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:ZBZt7PQlN9hybaN53lVMD3Wr8w/AulcP7/Y6wnIUYAoUyYNsKqlaO:bZZQVlK3Wa4cT/rFh5++V
TLSH T1B0453312BB2ED3A9F5F08175F61C8400B371CA4581AAF04E5CF4F7D89D82A575CC57AA
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:DHL exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
443
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
DHL Invoice.exe
Verdict:
Malicious activity
Analysis date:
2025-02-01 16:06:44 UTC
Tags:
formbook xloader
Link:
https://app.any.run/tasks/b7347723-8da0-416b-a1d0-a59fb1373057

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Sanesecurity.Malware.24184.7zHeur.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=679e40e1a9881a7a01c4e7b0
Tags:
micro
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Launching cmd.exe command interpreter
Сreating synchronization primitives
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/679e40df503cb0637f9baeff/reports/7636c7a8-92b8-4619-9374-2e7bc9e446e8/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/009ba20b8c436d6b47e991e7a7f5afa3999f34096b3ee207fed916ab53af7c9b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/36b7fc35-78e1-4731-af7f-e0abe0b9d93a
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1604519
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to resolve many domain names, but no domain seems valid
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1604519 Sample: DHL Invoice.exe Startdate: 01/02/2025 Architecture: WINDOWS Score: 100 26 www.nstaplan.xyz 2->26 28 www.eusx.xyz 2->28 30 9 other IPs or domains 2->30 32 Found malware configuration 2->32 34 Malicious sample detected (through community Yara rule) 2->34 36 Antivirus detection for URL or domain 2->36 40 11 other signatures 2->40 11 DHL Invoice.exe 2 2->11         started        signatures3 38 Performs DNS queries to domains with low reputation 28->38 process4 signatures5 50 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 11->50 52 Writes to foreign memory regions 11->52 54 Injects a PE file into a foreign processes 11->54 14 InstallUtil.exe 11->14         started        process6 signatures7 56 Modifies the context of a thread in another process (thread injection) 14->56 58 Maps a DLL or memory area into another process 14->58 60 Sample uses process hollowing technique 14->60 62 4 other signatures 14->62 17 explorer.exe 96 1 14->17 injected process8 process9 19 wscript.exe 17->19         started        signatures10 42 Modifies the context of a thread in another process (thread injection) 19->42 44 Maps a DLL or memory area into another process 19->44 46 Tries to detect virtualization through RDTSC time measurements 19->46 48 Switches to a custom stack to bypass stack traces 19->48 22 cmd.exe 1 19->22         started        process11 process12 24 conhost.exe 22->24         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/009ba20b8c436d6b47e991e7a7f5afa3999f34096b3ee207fed916ab53af7c9b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/009ba20b8c436d6b47e991e7a7f5afa3999f34096b3ee207fed916ab53af7c9b/
Threat name:
ByteCode-MSIL.Trojan.VIPKeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-02-01 14:00:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=acn2ec4minwwwr7jsht2p5npuomz6najnm7oeb763elkwu5ppsnq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery
Link:
https://tria.ge/reports/250201-ta57haypdy/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/40048881-f737-4505-9cf4-bddf5679d068
Unpacked files
SH256 hash:
713e2b561d32ab9ba4e8239f1887785363f2f3c9a618967c0d083cb94da1f411
MD5 hash:
a98ef02f34c557e92592cd40a9ea9e77
SHA1 hash:
c88752dbe04f709956f8305bcb312f386f742dbb
Detections:
FormBook
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
Windows_Trojan_Formbook
Create hunting rule
Formbook
Create hunting rule
Link:
https://www.unpac.me/results/6dbefb3e-cc33-4a16-ba85-56b0d046c0b4/
Parent samples :
cdb3229e64d90c75e9205357001b037333e36ecf141098dab1971d82cfa238ee
009ba20b8c436d6b47e991e7a7f5afa3999f34096b3ee207fed916ab53af7c9b
d24759c2da85654f95e71923c3b6a4ed23aee296e4fd70f436ee3bfa190647c4
762bfb4d60c0f58658f0f04470856ae4305c4d1f7d1f3fb9c053cbb5f15fd57e
be689687f31bdae68fe666068033c3ca36c2169bb27b4a7cf43db71826cb2753
SH256 hash:
dae8c1f11aadd2a5e2e8e1346fdd08545051c3fea7273a89a87065a806d63bcf
MD5 hash:
8b82e1e9128f25adfe881db412cb9675
SHA1 hash:
edf4945720a9c9b7842a9105dddebb9388288804
Link:
https://www.unpac.me/results/6dbefb3e-cc33-4a16-ba85-56b0d046c0b4/
SH256 hash:
3b7180ab224bd6bb060ae23f05c19330277cdd2f824bf7ae85f22322ee1b80a9
MD5 hash:
6e8b5d667d668d38ec7817694dfbfb9d
SHA1 hash:
b7fd0302c3aa4909b359447b9b781db3465efd90
Link:
https://www.unpac.me/results/6dbefb3e-cc33-4a16-ba85-56b0d046c0b4/
SH256 hash:
78f73e1734daa918b253517c75971fbb8df773a3d77d02a752e9a0ad1711a677
MD5 hash:
f9d2985aa1c41cca281321fffb5ed424
SHA1 hash:
3a7a58d2dcae2762882357ae34d372744b1dbb9d
Link:
https://www.unpac.me/results/6dbefb3e-cc33-4a16-ba85-56b0d046c0b4/
SH256 hash:
f4c1c59d30eef527e0e2ba78684e223354407115bd7dc85f6f62d083aad9ea80
MD5 hash:
b8be3578091015348385e044287d5a7a
SHA1 hash:
209c4a813abda8cd7669e08018b7ba8d20b97309
Link:
https://www.unpac.me/results/6dbefb3e-cc33-4a16-ba85-56b0d046c0b4/
SH256 hash:
9dd69d131277142846071e4396b523b9dfd65609c8f279cd4e50ff6274b29258
MD5 hash:
bad105478ee49f929a5ab741ad6acb3f
SHA1 hash:
0a1738768485b541b2472ffdb2c1d967886093f6
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/6dbefb3e-cc33-4a16-ba85-56b0d046c0b4/
SH256 hash:
009ba20b8c436d6b47e991e7a7f5afa3999f34096b3ee207fed916ab53af7c9b
MD5 hash:
69c8862e58dcc753cc52e3f73e36f78c
SHA1 hash:
9eaa869bc49a2282ef813d725b0238aca322af26
Link:
https://www.unpac.me/results/6dbefb3e-cc33-4a16-ba85-56b0d046c0b4/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/009ba20b8c43/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/009ba20b8c436d6b47e991e7a7f5afa3999f34096b3ee207fed916ab53af7c9b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.formbook.
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments