MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c733af349eb78d6db9adaabe29557488cf6e0b75539f37d70aefb0142b023e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c733af349eb78d6db9adaabe29557488cf6e0b75539f37d70aefb0142b023e9
SHA3-384 hash: 62f36bb0c6ee650cd75afbd4dc5363333c31c2516d1e22c987dc1dd3df972d13785900bb6d83488ce7671ce0be1934e7
SHA1 hash: a084881da52d3b51d9fd3e305b3c4b356d659603
MD5 hash: 6b3b139508623a37fd477a5f82a1c480
humanhash: robert-hamper-south-burger
File name:doc3303912024080112 RFQ.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'236'992 bytes
First seen:2024-09-09 13:24:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bbac62fd99326ea68ec5a33b36925dd1 (46 x AgentTesla, 38 x njrat, 27 x Formbook)
ssdeep 24576:I4lavt0LkLL9IMixoEgeaSYe7m/cCYfchztqI7l+9q9MmCS:fkwkn9IMHeaSYeC/cvf4dl6aPCS
TLSH T16245CF0373ED83A1C3725173BA66BB01AEBB7C2506A5F59B2FD4093DF920162521E673
TrID 63.7% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
11.6% (.EXE) Win64 Executable (generic) (10523/12/4)
7.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
5.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
419
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
doc3303912024080112 RFQ.exe
Verdict:
No threats detected
Analysis date:
2024-09-09 13:26:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c569d3b5-21aa-4cfb-81bd-cb6103f05c81

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Inject2.32012.20421.30715.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66def730ee4e815578171910
Tags:
Inject
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit fingerprint keylogger lolbin microsoft_visual_cc packed shell32
Link:
https://www.filescan.io/uploads/66def733f3d08fbdb578635a/reports/a02a67fe-1b7e-4ba2-ae1a-de8bf737e327/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/0c733af349eb78d6db9adaabe29557488cf6e0b75539f37d70aefb0142b023e9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1b30edda-deef-4d68-9aae-bf182798d5f9
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1507987
Signature
AI detected suspicious sample
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0c733af349eb78d6db9adaabe29557488cf6e0b75539f37d70aefb0142b023e9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0c733af349eb78d6db9adaabe29557488cf6e0b75539f37d70aefb0142b023e9/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=brztv42j5n4nnw423kv6ffkxjcgpnyfxku47g7lqv35qcqvqepuq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/240909-qnyg2asema/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ccc1a204-7e4e-4ba9-a47d-59d0d976059c
Unpacked files
SH256 hash:
d97d8c0aaf41110d74792569cbb55f31646a3e9a9578d0040160654d0b1daaa6
MD5 hash:
3f98f227e0687ba1b2a5b72914baa5fc
SHA1 hash:
76220aa6a47e36e6de5b43a379409a5ecd3b4a3b
Detections:
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
Link:
https://www.unpac.me/results/813908a7-6679-472f-85b2-0fadcac8c267/
Parent samples :
12fc2e0e6707ea1ec32fbfcb14e0e010e59012f8212e1a4b6d802bd2acf9f291
d1c666205b235382db9af2fcf2323899f933d6491b20070b7e22a95fe39bead6
9ba69b8eebbd8d46fd1a1a45bd1ee9458c576a0ea4be62b75d2d4a7c3700b629
c722967be032ad85338cf5d36d8887d790fa5e3df4daaface3522666ff31713b
dd95ad614d09e77335120d4e10cf4af0ae5dc3e4c8ab8cf80646f121e7f8a793
d1fdfe0dfc8979b2d71ef62985584396a9eb5f71975fe75e2ff842d890a19a4b
0c733af349eb78d6db9adaabe29557488cf6e0b75539f37d70aefb0142b023e9
fb4e1cd3c6776ad26213bbb64a2b6952316fa7ff476c80ac47ce123073860704
SH256 hash:
8ee9bef9328fb692fc490bcfd2d6a8216fec2cbb16b91530e7df25f30713bc8f
MD5 hash:
27e77bcdc948fc545c5bc58d44c6ac0d
SHA1 hash:
f73da9eb4789f44d23cce8e8753b71a116b418d0
Link:
https://www.unpac.me/results/813908a7-6679-472f-85b2-0fadcac8c267/
SH256 hash:
0c733af349eb78d6db9adaabe29557488cf6e0b75539f37d70aefb0142b023e9
MD5 hash:
6b3b139508623a37fd477a5f82a1c480
SHA1 hash:
a084881da52d3b51d9fd3e305b3c4b356d659603
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/813908a7-6679-472f-85b2-0fadcac8c267/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0c733af349eb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0c733af349eb78d6db9adaabe29557488cf6e0b75539f37d70aefb0142b023e9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 0c733af349eb78d6db9adaabe29557488cf6e0b75539f37d70aefb0142b023e9

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::CopySid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::GetAce
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
IPHLPAPI.DLL::IcmpCreateFile
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments