MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 035339241d84eb0505b506e55aa659e4f4b272e6986c0ca99cca2ce5a4b9f6af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 035339241d84eb0505b506e55aa659e4f4b272e6986c0ca99cca2ce5a4b9f6af
SHA3-384 hash: d1039c1fc1820525194ba59fb49c624daf1ec8b5d8f10e460a587c5cbfd162d54326433fdf9053ab58d98620793c1681
SHA1 hash: cfcc50423f0f4bcf79f1bdcebb22c6565535b648
MD5 hash: 1875a74ecee4059de5278227a9a36e75
humanhash: edward-batman-march-tennessee
File name:SCAN DOCUMENTS.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:388'233 bytes
First seen:2023-10-03 07:03:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:CZ3rvK8/RHDdp/y+Xo9b2YbsX3WNPpTwVoMQftgzZMp0Ui0JmZqLNELq/:krvKqHLy+XmdwGNKEglI5jSLg
TLSH T17C8423D52E27BDC2C60DD0DBA7ABBC497762485802588D1A5F0666DEC0A5361FFCECC8
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:FormBook zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Sales Manager <office@sanres.ch>" (likely spoofed)
Received: "from [194.180.49.66] (unknown [194.180.49.66]) "
Date: "3 Oct 2023 04:30:42 +0200"
Subject: "Signed Purchase Order: PO/US/4509622207"
Attachment: "SCAN DOCUMENTS.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:SCAN DOCUMENTS.exe
File size:401'929 bytes
SHA256 hash: 53f8211db510203634da93d5f2616ead5784031d1fd9d1ad245e25719fa974a9
MD5 hash: 68fa6c054b7a55d1943b2449ff295dab
MIME type:application/x-dosexec
Signature Formbook
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25455.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/035339241d84eb0505b506e55aa659e4f4b272e6986c0ca99cca2ce5a4b9f6af/results/dashboard
Gathering data
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/035339241d84eb0505b506e55aa659e4f4b272e6986c0ca99cca2ce5a4b9f6af
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/035339241d84eb0505b506e55aa659e4f4b272e6986c0ca99cca2ce5a4b9f6af
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/035339241d84eb0505b506e55aa659e4f4b272e6986c0ca99cca2ce5a4b9f6af/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2023-10-03 07:03:22 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=anjtsja5qtvqkbnva3svvjsz4t2le4xgtbwazkm4ziwoljfz62xq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/231003-kep7eabc74/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/035339241d84eb0505b506e55aa659e4f4b272e6986c0ca99cca2ce5a4b9f6af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 035339241d84eb0505b506e55aa659e4f4b272e6986c0ca99cca2ce5a4b9f6af

(this sample)

Formbook

Executable exe 53f8211db510203634da93d5f2616ead5784031d1fd9d1ad245e25719fa974a9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 53f8211db510203634da93d5f2616ead5784031d1fd9d1ad245e25719fa974a9
  
Dropping
Formbook
  
Dropping
MD5 68fa6c054b7a55d1943b2449ff295dab

Comments