MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0e5dd52da4fa3d13be08ae1fdf59eddbcce0fe300006f0e84d7f885cb61ff0bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Emotet (aka Heodo)
Vendor detections: 16
| SHA256 hash: | 0e5dd52da4fa3d13be08ae1fdf59eddbcce0fe300006f0e84d7f885cb61ff0bb |
|---|---|
| SHA3-384 hash: | d43bc984f69b53472d254aa2a531f8017cffe45e3e754452aca9fd3817c2c2c50a5cf6b48a7ac49cb0f011e86d2a7f3d |
| SHA1 hash: | 008e440b1e376dff5037981bd3b04b393523d2e3 |
| MD5 hash: | e5c9351ebdaeb386786e6bcb16d1ab72 |
| humanhash: | tennessee-quiet-yankee-alpha |
| File name: | NMC ROYAL MEDICAL EQUIPMENT ORDER MAY 2022-pdf.exe |
| Download: | download sample |
| Signature | Heodo |
| File size: | 690'176 bytes |
| First seen: | 2022-05-18 10:59:29 UTC |
| Last seen: | 2022-05-18 11:58:22 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:oFBIGtQvXdDqIWTPWp3KST/Rpi6+C8a/zXHD3ezMQwcal:AuiWVWip3Ko+Ta/zj3ezrwc |
| TLSH | T158E4F11522A8DE90EDAA43BFD06645FC03757E16D502F74BCEA87CCA3D363C1461AA1B |
| TrID | 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.5% (.SCR) Windows screen saver (13101/52/3) 9.2% (.EXE) Win64 Executable (generic) (10523/12/4) 5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.9% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer) |
| Reporter |  malwarelabnet |
| Tags: | Emotet exe Heodo xloader |
Intelligence
File Origin
# of uploads :
2
# of downloads :
251
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
ID:
1
File name:
NMC ROYAL MEDICAL EQUIPMENT ORDER MAY 2022-pdf.exe
Verdict:
Malicious activity
Analysis date:
2022-05-18 11:02:44 UTC
Tags:
formbook trojan stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-05-18 03:02:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
20 of 26 (76.92%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Result
Malware family:
xloader
Score:
10/10
Tags:
family:formbook family:xloader campaign:d6fp loader persistence rat spyware stealer suricata trojan
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
System policy modification
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Deletes itself
Reads user/profile data of web browsers
Adds policy Run key to start application
Blocklisted process makes network request
Xloader Payload
Formbook
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
Unpacked files
SH256 hash:
be6458bd999d52c751590ce4d8f45160e19a0a7a614996f745c3480ea335d644
MD5 hash:
7af322c4073a8866cd02f7061c0c3ad2
SHA1 hash:
03142c0bfeee917284de9199ad6792a50503771e
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
5dd4f09bb7649ecdfe1413a6cf00f3ac8ea133d39aa4e57bf5a7bb0804620d1f
MD5 hash:
c6b3ac9feae7e6670149f22e00e8fd43
SHA1 hash:
7da563c918506a0d384bbab1e6a88c6a59e22d55
SH256 hash:
09602efe05dc6b9738b23b91708978231d20c08329940541a086561795a6c9fd
MD5 hash:
1521132bd568891debf24b4973aaa24e
SHA1 hash:
393fafe43a177d02d2a8be164101fc2add2748dc
SH256 hash:
8f297674b8e51f37fdc59af8269cdbd0ceb03ca2dcb6974bf47cf324baa3a588
MD5 hash:
91af5076610b06b1fd2e13c4c2d9e7d5
SHA1 hash:
2bc527904d3dba71317dd2a12ded859618d35d8f
SH256 hash:
0e5dd52da4fa3d13be08ae1fdf59eddbcce0fe300006f0e84d7f885cb61ff0bb
MD5 hash:
e5c9351ebdaeb386786e6bcb16d1ab72
SHA1 hash:
008e440b1e376dff5037981bd3b04b393523d2e3
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.