MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08da4e7de40f2eec9cd1670e3db354d49d3101fd9ace7aaa5f99b235d2ce46ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08da4e7de40f2eec9cd1670e3db354d49d3101fd9ace7aaa5f99b235d2ce46ff
SHA3-384 hash: 8b922e35d45b95f38ed6f6264f4b8cf1182278ae17c2449745b90463df0381bed81b74ff63c80705f143e4b80980e6bd
SHA1 hash: 2f175d971e4d6f4938083a78de9be10eb6ba0e05
MD5 hash: b0901d0a6b90e6b371ba80e2c31ade52
humanhash: six-colorado-steak-two
File name:b0901d0a6b90e6b371ba80e2c31ade52
Download: download sample
Signature Formbook
Create hunting rule
File size:1'116'672 bytes
First seen:2021-06-10 15:52:38 UTC
Last seen:2021-06-10 17:47:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:kjuGIZRZkzHu3vmulMV40KJMp13ddUiJtYeYqHOqxiAwXSYhYQi32qNmTEdofxrh:kkGzihU31NddnYqueVK+cFWJGytwf
Threatray 5'368 similar samples on MalwareBazaar
TLSH F235AD6D3A40F6CFC767CC32C8A45D38E7A5A47B430BD783A56355DC8A4DD9AEE040A2
Reporter zbetcheckin
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
INQUIRY-PO3010773..EPR55804.doc
Verdict:
Malicious activity
Analysis date:
2021-06-10 14:29:23 UTC
Tags:
exploit CVE-2017-11882
Link:
https://app.any.run/tasks/cf9efd9e-b170-4e21-8e69-51c03f1f9fb6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/165912/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.832.11563.6313.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/800337
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 432733 Sample: GiG35Rwmz6 Startdate: 10/06/2021 Architecture: WINDOWS Score: 100 31 www.hometheaterplanning.com 2->31 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus / Scanner detection for submitted sample 2->43 45 7 other signatures 2->45 11 GiG35Rwmz6.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...behaviorgraphiG35Rwmz6.exe.log, ASCII 11->29 dropped 55 Detected unpacking (changes PE section rights) 11->55 57 Detected unpacking (overwrites its own PE header) 11->57 59 Tries to detect virtualization through RDTSC time measurements 11->59 61 Injects a PE file into a foreign processes 11->61 15 GiG35Rwmz6.exe 11->15         started        signatures6 process7 signatures8 63 Modifies the context of a thread in another process (thread injection) 15->63 65 Maps a DLL or memory area into another process 15->65 67 Sample uses process hollowing technique 15->67 69 Queues an APC in another process (thread injection) 15->69 18 explorer.exe 15->18 injected process9 dnsIp10 33 www.intentguild.com 104.161.84.111, 49755, 80 IOFLOODUS United States 18->33 35 www.didyouswipe.com 154.214.84.117, 49763, 80 DXTL-HKDXTLTseungKwanOServiceHK Seychelles 18->35 37 www.uebfaushb.com 18->37 47 System process connects to network (likely due to code injection or exploit) 18->47 22 help.exe 18->22         started        signatures11 process12 signatures13 49 Modifies the context of a thread in another process (thread injection) 22->49 51 Maps a DLL or memory area into another process 22->51 53 Tries to detect virtualization through RDTSC time measurements 22->53 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/08da4e7de40f2eec9cd1670e3db354d49d3101fd9ace7aaa5f99b235d2ce46ff/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-06-10 12:53:34 UTC
File Type:
PE (.Net Exe)
Extracted files:
55
AV detection:
18 of 29 (62.07%)
Threat level:
  1/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0ebd7f2342b476608315fc5ef48bc17f0384306094db09179e55af8b5b87e64f
Formbook
12afc4ae77a04bd359162284e418636d15db98680501a82cd045f323ccf8992d
Formbook
58626b2130d20a2bacbcefa97d06dc1e4d55b123a86a3f074bd2e8212ee60ae8
Formbook
6e1a82800736b1a05851d8eeca004861946ad916fe5566796e9303766de80131
Formbook
8eb6fcb3e943426769b1433c8eafd4d87d2d255b7545f92ce570f73803a9a898
Formbook
8f6fcbc62fb32a19196119ccaa6e45a5eabb8ed2aad233e5ea910dd3e6bde421
Formbook
9269d3cadb8c6197fa6d8cc93549e8f13db426b0b7d84f45923f24e99c429aee
Formbook
9f1090c3e94e75b134c1aa55b5e8e2b6ac9b706cd27e0bb1cc44ef4b49f27c66
Formbook
a2188f5cec31614ed7c703daa97120e115d18d6887a0f9f6061278ec0cd88fdf
Formbook
f8c3b9a8f01e022158ef5f9bc6d69287b6b03ce5527f7ac911de25dcdc016569
Formbook
+ 5'358 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210610-6e86ysva3e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.studiooculto.com/n8ud/
Unpacked files
SH256 hash:
e987e066b6b1ca5c3698a367d405b671a7f33e388289cb6b191faf4796478596
MD5 hash:
8b3814abb5e9cd9fb5da34bc71a4afc2
SHA1 hash:
8005c030dd9d0c1f146d18c4597f0a0f55e16577
Link:
https://www.unpac.me/results/48ea52d3-ff39-43fa-8d15-af0e3a04e6e7/
SH256 hash:
08da4e7de40f2eec9cd1670e3db354d49d3101fd9ace7aaa5f99b235d2ce46ff
MD5 hash:
b0901d0a6b90e6b371ba80e2c31ade52
SHA1 hash:
2f175d971e4d6f4938083a78de9be10eb6ba0e05
Link:
https://www.unpac.me/results/48ea52d3-ff39-43fa-8d15-af0e3a04e6e7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/08da4e7de40f2eec9cd1670e3db354d49d3101fd9ace7aaa5f99b235d2ce46ff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 08da4e7de40f2eec9cd1670e3db354d49d3101fd9ace7aaa5f99b235d2ce46ff

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1349924/
Cape
Cape
https://www.capesandbox.com/analysis/165912/

Comments