MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 088cc7491fc68b14d1e883a36a411b992ef71a038526e9b15b820985d3bbb7d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | 088cc7491fc68b14d1e883a36a411b992ef71a038526e9b15b820985d3bbb7d2 |
|---|---|
| SHA3-384 hash: | 05c4c4c770d8fbeee1e70b8917090ba21588fd573db7723ad724318de6c38c449711a955f8dd5f7c096fa8fc2b64a265 |
| SHA1 hash: | 2b1f4c831102d97803a31a9d61ad9ce9b37bb1fa |
| MD5 hash: | ce6a283006e8cb7e5855f2d9bd8ca76f |
| humanhash: | four-pizza-eight-hamper |
| File name: | DHL Invoices_pdf.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 456'119 bytes |
| First seen: | 2022-01-19 07:18:03 UTC |
| Last seen: | 2022-01-19 15:12:20 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla) |
| ssdeep | 6144:HwSohziiwJlpu7buU9BmN/N5Zc6/IMKnSq49jcwIVcyEy:6hui4lpu7brsa61rCwI3P |
| Threatray | 10'346 similar samples on MalwareBazaar |
| TLSH | T178A4D0D1F194C8DAE5AB14B2EC2AD5F022966E8CD198564F26D63F0A79B3383105FD0F |
| File icon (PE): |  |
| dhash icon | e8ecaccc14b2db65 (2 x RemcosRAT, 2 x Formbook, 1 x AgentTesla) |
| Reporter |  lowmal3 |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Creating a window
Searching for the window
Creating a file
Unauthorized injection to a recently created process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
DNS request
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Executable has a suspicious name (potential lure to open the executable)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Yara detected FormBook
Behaviour
Behavior Graph:
Detection:
xloader
Threat name:
Win32.Worm.SpyBot
Status:
Malicious
First seen:
2022-01-19 07:18:13 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
24 of 28 (85.71%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 10'336 additional samples on MalwareBazaar
Result
Malware family:
xloader
Score:
10/10
Tags:
family:xloader campaign:quc5 loader rat
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Xloader Payload
Xloader
Unpacked files
SH256 hash:
2016760276966e7d0a1b3ce5eb62661ee8e92f66e5c04da23d3862c7c2e463f2
MD5 hash:
2cb4c00b5b6341dba4b67aa976efbbd2
SHA1 hash:
0d35ccfebfa45994f925c133ef0477cb33619a24
Detections:
win_formbook_g0
win_formbook_auto
Parent samples :
088cc7491fc68b14d1e883a36a411b992ef71a038526e9b15b820985d3bbb7d2
d53203021ea88e690e9254aff60634fbafd324c69bebcd705506046e0647eb88
2eba3f9d82559ae0f8d15c141d3844ad3ae4e98c786ab6720506ab3e80565d8f
07569721866b0b2b3d83ec0db9d400f9cd623c51ea30706aaef9e032ec64795e
db9a46ce4d2d56fb75e4990521c1e905526268b1a6f51311bb8ed6cc6a3ee7b1
ffbd8cb5a8779c934324bbee870d6b1d7549d4c6eb358cd67b923aa8a5b21a36
d53203021ea88e690e9254aff60634fbafd324c69bebcd705506046e0647eb88
2eba3f9d82559ae0f8d15c141d3844ad3ae4e98c786ab6720506ab3e80565d8f
07569721866b0b2b3d83ec0db9d400f9cd623c51ea30706aaef9e032ec64795e
db9a46ce4d2d56fb75e4990521c1e905526268b1a6f51311bb8ed6cc6a3ee7b1
ffbd8cb5a8779c934324bbee870d6b1d7549d4c6eb358cd67b923aa8a5b21a36
SH256 hash:
2e1ff2053a2bb121107e3dbba19de64e89b1ab399eefa88e1e50e51dc09a70b3
MD5 hash:
c4db460df1b1c80f81bc2bbae4e2c0cd
SHA1 hash:
b7ce4332b8c3ec8b094601a90d533529acf5ff8e
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
8b9011983dbd573047cefa602efdf328a40ea2e232bcd6701ae615c77d24a933
MD5 hash:
6a419213d402729f9679931ab6a44e14
SHA1 hash:
9f2404055f78cbf129b673f6d70a1606f07329ad
SH256 hash:
088cc7491fc68b14d1e883a36a411b992ef71a038526e9b15b820985d3bbb7d2
MD5 hash:
ce6a283006e8cb7e5855f2d9bd8ca76f
SHA1 hash:
2b1f4c831102d97803a31a9d61ad9ce9b37bb1fa
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.63
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Formbook |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect Formbook in memory |
| Reference: | internal research |
| Rule name: | win_formbook_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.formbook. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.