MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 094dc63a99e7f4978723577fdbbbadc74ffa4b907368c0cd48b3d0b5f14e3fbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 094dc63a99e7f4978723577fdbbbadc74ffa4b907368c0cd48b3d0b5f14e3fbc
SHA3-384 hash: 8208f315579f6ce4a0cb1d1a7be82a38c0f4edabc8f786aa5aeb1c59efe9e8262b56f5972582bc2de98184f2bf5068a6
SHA1 hash: a4b570e82dab02e6d2a6426681ef331cc2f98889
MD5 hash: d0347dd826e8aaf5b7e999f1d5ff818c
humanhash: orange-massachusetts-leopard-ohio
File name:OUTSTANDING PI770100059 SOA OCT 2022.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:256'808 bytes
First seen:2022-11-11 07:04:59 UTC
Last seen:2022-11-12 10:12:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1f23f452093b5c1ff091a2f9fb4fa3e9 (276 x GuLoader, 37 x RemcosRAT, 23 x AgentTesla)
ssdeep 6144:cIw3X5w5gRQuyfcXvTmSEbqi7bpHxVxYpTSEdY:qw5AQmvqS07bpHxPYp+T
TLSH T1B244F1353B928037DC290A390C57EDA60F90DC13146C961703A8B7A56E33F699D5EFAE
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 408296e096822082 (1 x GuLoader, 1 x Formbook)
Reporter GovCERT_CH
Tags:exe FormBook signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2022-10-11T19:12:43Z
Valid to:2025-10-10T19:12:43Z
Serial number: 150ae6c82c3684b7
Thumbprint Algorithm:SHA256
Thumbprint: 5ab1007b4bbe24d5d75ea1c661090bd753db0e52a23517c6ffb137cd8ef9c908
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
4
# of downloads :
197
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
guloader
Create hunting rule
ID:
1
File name:
OUTSTANDING PI770100059 SOA OCT 2022.exe
Verdict:
Malicious activity
Analysis date:
2022-11-11 07:07:12 UTC
Tags:
guloader
Link:
https://app.any.run/tasks/41f66722-927c-4adb-93b4-3accef10a9a4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/332315/
Detection(s):
SecuriteInfo.com.W32.Ninjector.GV.gen.Eldorado.32632.28304.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a window
Creating a file
Sending a custom TCP request
Delayed reading of the file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/51245/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/636df4226e54ea7258283eb0/reports/8bea03f1-c92d-4414-874a-8b29ce9c60bc/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/08ca2966-999b-4370-8b26-ea26079be5ee
Result
Threat name:
FormBook, GuLoader
Create hunting rule
Detection:
malicious
Classification:
evad.troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1111066
Signature
C2 URLs / IPs found in malware configuration
Hides threads from debuggers
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect Any.run
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses netstat to query active network connections and open ports
Writes to foreign memory regions
Yara detected FormBook
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 743762 Sample: OUTSTANDING PI770100059 SOA... Startdate: 11/11/2022 Architecture: WINDOWS Score: 100 33 www.zumbawithdiane.com 2->33 35 www.vnsuda.lol 2->35 37 24 other IPs or domains 2->37 47 Snort IDS alert for network traffic 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 3 other signatures 2->53 10 OUTSTANDING PI770100059 SOA OCT 2022.exe 2 30 2->10         started        signatures3 process4 file5 31 C:\Users\user\AppData\Local\...\System.dll, PE32 10->31 dropped 67 Tries to detect Any.run 10->67 69 Hides threads from debuggers 10->69 14 OUTSTANDING PI770100059 SOA OCT 2022.exe 6 10->14         started        signatures6 process7 dnsIp8 45 vashovskycorp.com 192.163.206.80, 443, 49839 UNIFIEDLAYER-AS-1US United States 14->45 71 Modifies the context of a thread in another process (thread injection) 14->71 73 Tries to detect Any.run 14->73 75 Maps a DLL or memory area into another process 14->75 77 3 other signatures 14->77 18 explorer.exe 14->18 injected 22 RAVCpl64.exe 14->22 injected signatures9 process10 dnsIp11 39 hf9blwwuwpx7j8k.live 216.18.208.202, 49880, 49881, 49882 WEBNXUS United States 18->39 41 www.primeworkspace.net 103.7.9.22, 49863, 49864, 49865 USONYX-AS-APUSONYXPTELTDSG Singapore 18->41 43 18 other IPs or domains 18->43 55 System process connects to network (likely due to code injection or exploit) 18->55 57 Uses netstat to query active network connections and open ports 18->57 24 NETSTAT.EXE 13 18->24         started        27 autofmt.exe 22->27         started        signatures12 process13 signatures14 59 Tries to steal Mail credentials (via file / registry access) 24->59 61 Tries to harvest and steal browser information (history, passwords, etc) 24->61 63 Writes to foreign memory regions 24->63 65 3 other signatures 24->65 29 firefox.exe 24->29         started        process15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/094dc63a99e7f4978723577fdbbbadc74ffa4b907368c0cd48b3d0b5f14e3fbc/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2022-11-10 21:19:16 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
12 of 26 (46.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bfg4mouz472jpbzdk575xo5ny5h7us4qonumbtkiwpill4koh66a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
cloudeye
Create hunting rule
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:gkr4 rat spyware stealer trojan
Link:
https://tria.ge/reports/221111-hwh4bacafq/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent file
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Formbook
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/34152983-1d77-4279-b03e-094d72386c34
Unpacked files
SH256 hash:
f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
MD5 hash:
8b3830b9dbf87f84ddd3b26645fed3a0
SHA1 hash:
223bef1f19e644a610a0877d01eadc9e28299509
Link:
https://www.unpac.me/results/3f733cf0-18e0-40e2-9c6a-d5fe39ae012d/
SH256 hash:
094dc63a99e7f4978723577fdbbbadc74ffa4b907368c0cd48b3d0b5f14e3fbc
MD5 hash:
d0347dd826e8aaf5b7e999f1d5ff818c
SHA1 hash:
a4b570e82dab02e6d2a6426681ef331cc2f98889
Link:
https://www.unpac.me/results/3f733cf0-18e0-40e2-9c6a-d5fe39ae012d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/094dc63a99e7f4978723577fdbbbadc74ffa4b907368c0cd48b3d0b5f14e3fbc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 321d873997c3568cd7742f195eb6118860620bf44c6e1dbe16e6c2123cca5cbf

Formbook

Executable exe 094dc63a99e7f4978723577fdbbbadc74ffa4b907368c0cd48b3d0b5f14e3fbc

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/332315/
  
Dropped by
SHA256 321d873997c3568cd7742f195eb6118860620bf44c6e1dbe16e6c2123cca5cbf
  
Dropped by
MD5 8fa695655d43a0d7880e5a1cad359f59

Comments