MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00c2d72b6a63a14fbe34e3fb19fad396213bb9be21ff695df527a676b866c8b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00c2d72b6a63a14fbe34e3fb19fad396213bb9be21ff695df527a676b866c8b2
SHA3-384 hash: d6af5a6e52a9d977d9906932b5d1d4a4d493b8fa5a41c43a821518d95ace4ce6ffe020137d8021e4f06840bcfe662ac3
SHA1 hash: c3288325246f98f3e388795f7d34d4ce4a8adb08
MD5 hash: 3aae187307a535df90ed8f9faa0341d2
humanhash: tango-don-winter-oranges
File name:DHL_734825510.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:743'936 bytes
First seen:2024-12-06 16:34:02 UTC
Last seen:2025-01-10 14:10:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fc6683d30d9f25244a50fd5357825e79 (92 x Formbook, 52 x AgentTesla, 23 x SnakeKeylogger)
ssdeep 12288:9quErHF6xC9D6DmR1J98w4oknqOOCyQfF5JZPuph9QMbbTDMFgS1zv4ptuF/YXSA:grl6kD68JmlotQfp9m9lbxa4yFwAq
TLSH T1EBF423898285D9B6C71463754429CDC48A74B4728ECD678F8328FA2FFC21353ED6BA5C
TrID 31.3% (.EXE) UPX compressed Win32 Executable (27066/9/6)
30.7% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
12.1% (.EXE) Win64 Executable (generic) (10522/11/4)
7.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
5.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
File icon (PE):PE icon
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter abuse_ch
Tags:DHL exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
425
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL_734825510.exe
Verdict:
No threats detected
Analysis date:
2024-12-06 16:47:16 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b8fa4c7c-1367-4e91-a8d8-87044d6693eb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.30025.9201.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6753278503fccedbc6498f3b
Tags:
shellcode emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/00c2d72b6a63a14fbe34e3fb19fad396213bb9be21ff695df527a676b866c8b2
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3254945e-f333-46c2-9bda-b24b34eff37c
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1570251
Signature
AI detected suspicious sample
Antivirus detection for URL or domain
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1570251 Sample: DHL_734825510.exe Startdate: 06/12/2024 Architecture: WINDOWS Score: 100 28 www.egyshare.xyz 2->28 30 www.egldfi.xyz 2->30 32 17 other IPs or domains 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Antivirus detection for URL or domain 2->44 46 Multi AV Scanner detection for submitted file 2->46 50 3 other signatures 2->50 10 DHL_734825510.exe 2 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 30->48 process4 signatures5 62 Writes to foreign memory regions 10->62 64 Maps a DLL or memory area into another process 10->64 66 Switches to a custom stack to bypass stack traces 10->66 13 svchost.exe 10->13         started        process6 signatures7 68 Maps a DLL or memory area into another process 13->68 16 RsbLJIqaDYs.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 regini.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 RsbLJIqaDYs.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 bloodbalancecaps.shop 108.179.253.197, 50022, 50023, 50024 UNIFIEDLAYER-AS-1US United States 22->34 36 samundri.online 84.32.84.32, 49721, 49722, 49723 NTT-LT-ASLT Lithuania 22->36 38 7 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/00c2d72b6a63a14fbe34e3fb19fad396213bb9be21ff695df527a676b866c8b2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00c2d72b6a63a14fbe34e3fb19fad396213bb9be21ff695df527a676b866c8b2/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2024-12-06 14:53:06 UTC
File Type:
PE (Exe)
Extracted files:
51
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=adbnok3kmoqu7pru4p5rt6wtsyqtxon6eh7wsxpve6thnodgzcza._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
unknown_loader_036
Create hunting rule
Similar samples:
error
Formbook
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery upx
Link:
https://tria.ge/reports/241206-t24gzswra1/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Verdict:
Suspicious
Tags:
trojan
YARA:
SUSP_Imphash_Mar23_3
Link:
https://app.threat.zone/submission/50f6c623-9f04-4bb3-905e-621b605fcd3e
Unpacked files
SH256 hash:
c16a736911d0dc6c6d43680f5d771bdbee420f96eeb31f3302098d2d7fb1ea2d
MD5 hash:
6fe374eb8143a537c9be4297cc6a62b1
SHA1 hash:
b92e77e3cb8670b6e40843a6334efdb04d278b40
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/6a775bfe-8531-4b8a-b654-68463ee1c07b/
Parent samples :
00c2d72b6a63a14fbe34e3fb19fad396213bb9be21ff695df527a676b866c8b2
9d7f2010937a9fa39e59ac0b46dfe1efe6dd5bb0748e1b4bf172e849ff916fb1
df607dfa701d132a8679f0855bfdca430246d46285e36f46a965bb8a67f4d7b6
91ae1faec9830fc63441d4a2819d460fee2bace496c5f11663e81aa88f922d2f
a139ad8f39832bc6f3a7cbb950b49a3a4cef52888099d7fc662c52e1d6b39862
d88cbfff7d6a8163e124249f07e2f8434d6e5474fcda9f916f89afe50b88f413
SH256 hash:
7bc501d93a5bcec412a171b83123c6a4b975c78f9ad6d8edbc78717876a0020b
MD5 hash:
9c9e65b1df682423a3166b07b3460871
SHA1 hash:
16e124998359172eac3216bd9f25dcde2de0d386
Link:
https://www.unpac.me/results/6a775bfe-8531-4b8a-b654-68463ee1c07b/
SH256 hash:
a44f7253b3d3ed73938d591514c2546972780b67dde330967239fb7b1cba35d0
MD5 hash:
b7a589aa371b10e5650f8979e5cee31e
SHA1 hash:
d97f7e1dbac4275d58bc708251e637ee03dbb1df
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/6a775bfe-8531-4b8a-b654-68463ee1c07b/
SH256 hash:
00c2d72b6a63a14fbe34e3fb19fad396213bb9be21ff695df527a676b866c8b2
MD5 hash:
3aae187307a535df90ed8f9faa0341d2
SHA1 hash:
c3288325246f98f3e388795f7d34d4ce4a8adb08
Link:
https://www.unpac.me/results/6a775bfe-8531-4b8a-b654-68463ee1c07b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/00c2d72b6a63/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_Imphash_Mar23_3
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:Internal Research
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetAce
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetUseConnectionW

Comments