MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10107fb1848f1956607b0d3191a5dd2db01e027196990a652638b1aebaa2f879. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10107fb1848f1956607b0d3191a5dd2db01e027196990a652638b1aebaa2f879
SHA3-384 hash: ccab89a3528048f4d019f611f87bfd23d357fc038ee0b0f0a6bc155664561de5df022ca45beba98750ccff51138bfaa9
SHA1 hash: 482cb091f84a8d6d4013343f75e33b8decfa8d00
MD5 hash: 5f01ca4e29e96bdab360670439c77fb3
humanhash: mike-twenty-rugby-neptune
File name:QUOTATION.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:347'565 bytes
First seen:2023-09-13 11:33:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep 6144:vYa6Or/A8eFH0r64yGVmod0suIhXt4m3Jwat2V9DmL2hNgbDbZ+tKGKE9RveVRKW:vYIr47u6JTbIPRJw62OlfItK7gWPKKO6
Threatray 171 similar samples on MalwareBazaar
TLSH T1C074223933B6C8A7DA7A1332843953137EAE545305DA9B0B13683F6DBED1281E42F746
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter JAMESWT_WT
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
337
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
QUOTATION.exe
Verdict:
Suspicious activity
Analysis date:
2023-09-13 11:35:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4742ad1d-5437-4adb-b426-1bf49add5081

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/448378/
Detection(s):
SecuriteInfo.com.FileRepMalware.1668.21187.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Unauthorized injection to a recently created process by context flags manipulation
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/65019e2bda7b76f50a245a21/reports/5509b8a6-614e-4473-9008-8b33fbba4a4d/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/10107fb1848f1956607b0d3191a5dd2db01e027196990a652638b1aebaa2f879
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4d333b67-21a8-4f8f-99ec-ec89fe5a667b
Result
Threat name:
FormBook, NSISDropper
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1308239
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected FormBook
Yara detected NSISDropper
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1308239 Sample: QUOTATION.exe Startdate: 14/09/2023 Architecture: WINDOWS Score: 100 33 www.samjungnz.com 2->33 47 Malicious sample detected (through community Yara rule) 2->47 49 Antivirus detection for URL or domain 2->49 51 Antivirus / Scanner detection for submitted sample 2->51 53 5 other signatures 2->53 11 QUOTATION.exe 18 2->11         started        signatures3 process4 file5 31 C:\Users\user\AppData\Local\Temp\ysvmoh.exe, PE32 11->31 dropped 14 ysvmoh.exe 11->14         started        process6 signatures7 65 Antivirus detection for dropped file 14->65 67 Multi AV Scanner detection for dropped file 14->67 69 Machine Learning detection for dropped file 14->69 71 Maps a DLL or memory area into another process 14->71 17 ysvmoh.exe 14->17         started        process8 signatures9 41 Maps a DLL or memory area into another process 17->41 43 Sample uses process hollowing technique 17->43 45 Queues an APC in another process (thread injection) 17->45 20 cdBZJIxHCxvaWXARNiUN.exe 17->20 injected process10 process11 22 systray.exe 13 20->22         started        signatures12 55 Tries to steal Mail credentials (via file / registry access) 22->55 57 Tries to harvest and steal browser information (history, passwords, etc) 22->57 59 Modifies the context of a thread in another process (thread injection) 22->59 61 Maps a DLL or memory area into another process 22->61 25 explorer.exe 2 1 22->25 injected 29 cdBZJIxHCxvaWXARNiUN.exe 22->29 injected process13 dnsIp14 35 www.innovativefewsustra.com 199.21.76.77, 49732, 49733, 49734 VOXEL-DOT-NETUS United States 25->35 37 www.saintprojetdesalers.com 103.224.182.252, 49708, 49710, 49711 TRELLIAN-AS-APTrellianPtyLimitedAU Australia 25->37 39 9 other IPs or domains 25->39 63 System process connects to network (likely due to code injection or exploit) 25->63 signatures15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10107fb1848f1956607b0d3191a5dd2db01e027196990a652638b1aebaa2f879/
Threat name:
Win32.Ransomware.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-09-13 09:21:27 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
23 of 35 (65.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=caih7mmer4mvmyd3buyzdjo5fwyb4atrs2mquzjghcy25ovc7b4q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0694c6c0a52d6281f7ba9acc9de0549be7fd5bdb35e857609fc7adbfcda8c848
Formbook
1b29005d1fa110dfb5b924c879e64d7d4cce8af163f9e6853e4bbda2c298acf0
Formbook
1efb08a82cb31f0627287c5b4d31725dec2f9d5062cea032a454a9f1d953df5e
Formbook
232084d6349c62484d691cc32cbf5b9ed8c70932d8c4578876043bda903c45de
Formbook
4d698a32de4877e432bf6d6af790d86746adb3bd352844451a7505fb3d8b3492
Formbook
5453ab6ad1bde2f5286311d91550037266ec90d9b032c61969ef0196241746c9
Formbook
8249e88d3b270dba037eae0a0308f828f87e6a5c2c61678ef4943293cbe26fb3
Formbook
87c61e8ad5d2df24cc951473b77ec7ef6e2be9d37164ff829116c2cb73d2d8d7
Formbook
f6f14e614582f94e97f29dc96c69fa61767fd2f6bf5798ad96a7e3c34f189db7
Formbook
+ 161 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230913-npe1zaeb33/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
8da6c631891721a70583bffa4751383d4cda06518ecce4f1f9ec776958275dc5
MD5 hash:
00b6520b52b46c2d55040e5e7ceba137
SHA1 hash:
9f1d5866827c6b5a9ecc0a2430d26945a06246ff
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/27efd145-39bf-44c3-9c8f-7f3313045317/
SH256 hash:
958fc3dc4aa087f5be62ad196b2e035a1d129da08ec4e0fa56c6c2fd4451d0e5
MD5 hash:
f00afce759a84c9f4bec31dba11712b9
SHA1 hash:
648075cbd73534b55e7ea24672b1fcd55daa8bd0
Link:
https://www.unpac.me/results/27efd145-39bf-44c3-9c8f-7f3313045317/
SH256 hash:
033f6f14646e5fde5c0d84705b6724d34c5a544ef8de95aa98b95270ec551f7d
MD5 hash:
1e2b3dd93ba32c5d1612a117c45dffe8
SHA1 hash:
1d5a3c72b76545c4e68db22b5a3c31bab4d74cf3
Link:
https://www.unpac.me/results/27efd145-39bf-44c3-9c8f-7f3313045317/
SH256 hash:
10107fb1848f1956607b0d3191a5dd2db01e027196990a652638b1aebaa2f879
MD5 hash:
5f01ca4e29e96bdab360670439c77fb3
SHA1 hash:
482cb091f84a8d6d4013343f75e33b8decfa8d00
Link:
https://www.unpac.me/results/27efd145-39bf-44c3-9c8f-7f3313045317/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/10107fb1848f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/10107fb1848f1956607b0d3191a5dd2db01e027196990a652638b1aebaa2f879

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/448378/

Comments