MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 01b15d113f147c931149f8d1c883bbad3c3752cba08a96855774d21a3bb6e44a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 12
| SHA256 hash: | 01b15d113f147c931149f8d1c883bbad3c3752cba08a96855774d21a3bb6e44a |
|---|---|
| SHA3-384 hash: | 0057f8cde0965dd66065d0bbe3d95abf19c7afcda97b3ba8a9b097bce4d610d0e40ce417a1a4aaf589c413493bb560cb |
| SHA1 hash: | 7c5ace123ba02c959d6975de7e98cd98bbee1af6 |
| MD5 hash: | 8eaf93ff5a38924420772bb1f6c6632f |
| humanhash: | east-connecticut-papa-six |
| File name: | 1692962044883bbb5d51269554e7d6bcf8fa7f7f1820cf6ab699f2c0ccaab5d55041cf745a472.dat-decoded |
| Download: | download sample |
| Signature | Formbook |
| File size: | 235'520 bytes |
| First seen: | 2023-08-25 11:14:05 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| ssdeep | 6144:gyMcDUHLfVsd2aJnMyq2FwrvK7kkTQ1+uzi:UcD2foBnHzFwryI2Q1+uz |
| Threatray | 1'286 similar samples on MalwareBazaar |
| TLSH | T1173423BD9C0A5912D436A6391A4F1AFF43C63784DBF0176388ACA30759749E48BF54EC |
| Reporter |  abuse_ch |
| Tags: | base64-decoded exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
333
Origin country :
DEVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1692962044883bbb5d51269554e7d6bcf8fa7f7f1820cf6ab699f2c0ccaab5d55041cf745a472.dat-decoded
Verdict:
No threats detected
Analysis date:
2023-08-25 11:22:29 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
overlay packed
Verdict:
Malicious
Labled as:
Trojan.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj
Score:
76 / 100
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.FormBook
Status:
Malicious
First seen:
2023-08-24 19:04:07 UTC
File Type:
PE (Exe)
AV detection:
21 of 24 (87.50%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 1'276 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
4f4136ae04dc1d97003b566ee1f18454a1601c5d373466a84b0cca781967dbbf
MD5 hash:
928008fbb7ba983916004635aaf54a15
SHA1 hash:
0698b7dedcdff78f7db445a149cf5000afb0534c
Detections:
win_formbook_w0
win_formbook_g0
SH256 hash:
56cb92358c0379097b15c687b8731c2113e356e3f6ea2997d5603d79afeedb3b
MD5 hash:
d18d99e875b4508b1020bc93c2d65cf9
SHA1 hash:
a7ddfca37b349ee7c0a740794f13166b8293185a
SH256 hash:
d28a1dab89f8f70fb3591231fdb5bf94aabf89b155419595f31fab9c079654ec
MD5 hash:
bb555fb53eaa614fe2aadb0ead84b4c5
SHA1 hash:
21186c2e25c8763c19e84a338660e3e767ee3049
SH256 hash:
f7c64e20c430a8093f06ccad2d3bc58fe1306b07c38171e1e12e88d77c2aaeb7
MD5 hash:
aa2be70b46d8a6d95276650b3ed5ed92
SHA1 hash:
1a16ec865b910aa8fb336de65ee157f70370dc2f
SH256 hash:
d84a78d113abbbcae1256e8cfbe75743d957aeeb813f6b0b4805f30c5fbd307a
MD5 hash:
6de90999625eb7fe72f0c1a040d1d96b
SHA1 hash:
16d82ecf8c7d6f6fd4f94029577593813b7b61ef
SH256 hash:
22ac1cac63d3ebd74fe735781b82fd3c68474c8a48bd636cbbd1b200c94bc8e3
MD5 hash:
5b14a0dd545e42b1434a7b5a71ca24d2
SHA1 hash:
057e758b8fd33fae63eb8fd1d4a96bc5e474f090
SH256 hash:
01b15d113f147c931149f8d1c883bbad3c3752cba08a96855774d21a3bb6e44a
MD5 hash:
8eaf93ff5a38924420772bb1f6c6632f
SHA1 hash:
7c5ace123ba02c959d6975de7e98cd98bbee1af6
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.74
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | maldoc_getEIP_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
883bbb5d51269554e7d6bcf8fa7f7f1820cf6ab699f2c0ccaab5d55041cf745a
Dropped by
SHA256 883bbb5d51269554e7d6bcf8fa7f7f1820cf6ab699f2c0ccaab5d55041cf745a
Dropped by
MD5 4ca9f9775d3908fb6c63d12f03b80b5a
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.