MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12105f375305f03d5af6f358ee11910c1b5f61b678b53fff254e7aee4f766970. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12105f375305f03d5af6f358ee11910c1b5f61b678b53fff254e7aee4f766970
SHA3-384 hash: 47a8a28f1a16cf9a7d0be8a61bb549b2d96d4ecbbc8c7be912cbd1e74b819ca30b6653090d3eb783896324a7f9743e4a
SHA1 hash: 823d768bf2dac3ea01e18c2af4f3ac93d15a8c83
MD5 hash: 7a8feaa39d150a556185b1db88dc16e9
humanhash: washington-ink-north-three
File name:Purchase Order.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:574'971 bytes
First seen:2022-09-30 14:42:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:3j6uYu9np9Le0h8aoCLjRAb8wUykg8AwoX/5LdfOhtsU9x+:3jrHnLehTItAAwUyk+v/OhJ98
TLSH T1B4C423F6CE481EA65683ADB78F637E8D209C1F107D89C104D09D72D978F12CA59AA31F
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""SALES" <sales@exedisplay.com>" (likely spoofed)
Received: "from exedisplay.com (unknown [103.232.54.137]) "
Date: "27 Sep 2022 07:53:39 -0700"
Subject: "[#2605] REQUESTING FOR ORDER COMFIRMATION"
Attachment: "Purchase Order.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
186
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12105f375305f03d5af6f358ee11910c1b5f61b678b53fff254e7aee4f766970/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-09-27 08:05:21 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
13 of 41 (31.71%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ciif6n2taxyd2wxw6nmo4emrbqnv6ynwpc2t77zfjz5o4t3wnfya._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:gski rat spyware stealer trojan
Link:
https://tria.ge/reports/220930-r3kedsegcj/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/12105f375305f03d5af6f358ee11910c1b5f61b678b53fff254e7aee4f766970

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 12105f375305f03d5af6f358ee11910c1b5f61b678b53fff254e7aee4f766970

(this sample)

Formbook

Executable exe cee39c6232758ab3a4fee85e0cb63cc70e7247e2afc8e52e440ceb4039eee90c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cee39c6232758ab3a4fee85e0cb63cc70e7247e2afc8e52e440ceb4039eee90c
  
Dropping
Formbook

Comments