MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 145b44152f734c4d61c91aeee89d4ca15f7219a94c4879bfc46b628b6b9dbf7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 145b44152f734c4d61c91aeee89d4ca15f7219a94c4879bfc46b628b6b9dbf7b
SHA3-384 hash: d07cd5ae532cbaf931755424ab64ba872dfe3d03b6e638d1c0c92a092fcc11378d40b96148a8ffeb14d097f142a0130c
SHA1 hash: 0c220047cbfb6b24eeb22c1138c91c55f38cb59c
MD5 hash: 4f1e80d0fd558f58a4eb26b22128ed5b
humanhash: fifteen-shade-hotel-lactose
File name:Purchase Order_pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:432'283 bytes
First seen:2022-03-31 18:57:59 UTC
Last seen:2022-04-01 07:41:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (720 x GuLoader, 451 x Formbook, 295 x Loki)
ssdeep 6144:+NeZasyaQDj39w08ju6NR5sxsR5SXamRTYER59lHSNNgpOL/eXgFW:+NejxN4aRsXamFYEHyl//w
Threatray 14'574 similar samples on MalwareBazaar
TLSH T1D794D0523E59EC69E38A08342EB4D716ADFC9E5D0D664D07BB226FCDFD316853809322
File icon (PE):PE icon
dhash icon 68e8f0f0e86c6870 (1 x Formbook)
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.Variant.Nemesis.2757.19427.7109.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/12261/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe nemesis overlay packed python shell32.dll
Link:
https://www.filescan.io/uploads/6245f9be9253b276b7b6a2b4/reports/8770bad6-464e-4fdc-9931-96a374939d82/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0fac4f46-e904-46ed-837c-81f6e0821e2b
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/968589
Behaviour
Behavior Graph:
n/a
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/145b44152f734c4d61c91aeee89d4ca15f7219a94c4879bfc46b628b6b9dbf7b/
Threat name:
Win32.Trojan.Nemesis
Create hunting rule
Status:
Malicious
First seen:
2022-03-31 18:58:06 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
17 of 42 (40.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=crnuifjponge2yojdlxorhkmufpxegnjjrehtp6ennriw245x55q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1c6a3fdbe07eca91bb067a9ba1c90bd87df0d94a0f8c9d870c792baa4a040c45
Formbook
2ed8aeaf73ee1a3caf7eb0be7814868c4100efbe1b021e2d964db3b638dc7f3c
Formbook
51ca9a86ecb638b2805cd27a752159a05d4a3317c11ea43fb0f0cca78601c8dc
Formbook
945f67ae677681e14db036f753f47333556fea6f3837bef7399e440e6bc167d5
Formbook
bc09ecf5cb6364f4d053ec0420282fa6e7a1649a8a5ca2af2ca933aa27f8b90c
Formbook
cbf7dac8ee4dd46d48f7a0d6f0495d3d27ef5319fd05ace04aea7bfe96fe99c7
Formbook
d675408e7dcc87922c9d654a5c4f387f70d4a06ad99bad187753d90ee6381a87
Formbook
ec575e5cdf3da323c27e65f3042586173ca50ba0682b733a61f0b47f80c3004e
Formbook
ff3e94ded64b43f620ba549db99baa31abdd763209b60f7c9fc884b82cfac6d3
Formbook
+ 14'564 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:e0l9 rat spyware stealer trojan
Link:
https://tria.ge/reports/220331-xmgapagdf7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Formbook Payload
Formbook
Unpacked files
SH256 hash:
3efd4c095e8d7623b4f69d1f67cb2646da8ba6b53150c04da732f4b2a8ac4fce
MD5 hash:
86abf50025c229ed0da511ec51daca9b
SHA1 hash:
b5308d376cfc733143eb02a39e137a667ca6e030
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/dba9ba11-6274-48d5-af5c-23845cd4484c/
Parent samples :
01a7ac77b826e3f9507517f5dec1b39898fc543074a2b245f351e194317a7ecb
321ae247ce6d6539af41e802f8ad398dc2bcc56f81664bb46114d177caa896cf
11f9cf3e83d50d6db23ba46d367da519c510c00b993411c10e9e0e43bb333439
1f0dfaeee8860dd10d592b0632dc1ef8c2fa1bc9681e0f9e29ed632f2260abec
145b44152f734c4d61c91aeee89d4ca15f7219a94c4879bfc46b628b6b9dbf7b
2388aba5e29792fc92af726882eb073d8d896640df9926d0dcd7565e2ee41cce
6162886259356c9adedc20426142a0ef4306a961415a77016fa37bd6b87bb540
da4cb25d25388cef409303e2e4c3f2ec589d747d49e602ef924eaefbbaf75144
6ef2ea041f80bf832a51dcd24a4b42a16827176e7c677d479055de3c994793e5
SH256 hash:
9d0eb1d6fd610032efd64310a80eaacaa65fbe786f73fff79754b05c6479aa38
MD5 hash:
e1053435e6142a083e7ab100caba9de8
SHA1 hash:
b1e125e30c268b81b0d73d242fef4d810531d5ec
Link:
https://www.unpac.me/results/dba9ba11-6274-48d5-af5c-23845cd4484c/
SH256 hash:
b0872046415a3071ff7b0e57c74a432dd77e5d6d2143291fbe8d6561f05725fc
MD5 hash:
545e339639fa24235f8d080cad70d746
SHA1 hash:
a6d1c78aa65408f23da5df0c39fca0aedc72dc79
Link:
https://www.unpac.me/results/dba9ba11-6274-48d5-af5c-23845cd4484c/
SH256 hash:
145b44152f734c4d61c91aeee89d4ca15f7219a94c4879bfc46b628b6b9dbf7b
MD5 hash:
4f1e80d0fd558f58a4eb26b22128ed5b
SHA1 hash:
0c220047cbfb6b24eeb22c1138c91c55f38cb59c
Link:
https://www.unpac.me/results/dba9ba11-6274-48d5-af5c-23845cd4484c/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/145b44152f73/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/145b44152f734c4d61c91aeee89d4ca15f7219a94c4879bfc46b628b6b9dbf7b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 145b44152f734c4d61c91aeee89d4ca15f7219a94c4879bfc46b628b6b9dbf7b

(this sample)

  
Dropped by
formbook
  
Delivery method
Distributed via e-mail attachment

Comments