MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15303228b6250763173b667b553db40a0637af946cbca7310415d5b92032b9f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15303228b6250763173b667b553db40a0637af946cbca7310415d5b92032b9f3
SHA3-384 hash: 7054f99edbc97c1abf7248ba629fcda356903a0aa7d66066b366f41961160a2bfa550a304bd313ccf1764c59a9c491cf
SHA1 hash: 8c5ee585d13a0165c2896430999838db59a94516
MD5 hash: 98f9e9a5d39d967b857aabd08a12a944
humanhash: six-uniform-four-charlie
File name:00928377320212607_pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'287'680 bytes
First seen:2021-07-26 13:21:08 UTC
Last seen:2021-07-26 13:50:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:4sOsBgo0q4wM9BmCmTOUd+L6kNXW43MBnRTGMKpDzho4:4VoHM7mCm6Ud+zNXv3anxwpDzm4
Threatray 6'822 similar samples on MalwareBazaar
TLSH T10B55BFB10919EF22F4B706BD74725A4442B09D46C96FCB68FE7332ABCD70BC23456A91
dhash icon c49a18b4949c64d4 (6 x AgentTesla, 2 x Formbook, 1 x SnakeKeylogger)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
00928377320212607_pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-07-26 14:29:32 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/b940382b-657f-4600-b2f4-c58ee9ed0b8f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/174133/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.953-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Launching a process
Creating a process with a hidden window
Creating a file
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0bbeefa7-c255-4cc5-95b5-4941d632a87d
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/821803
Signature
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Powershell Defender Exclusion
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 454213 Sample: 00928377320212607_pdf.exe Startdate: 26/07/2021 Architecture: WINDOWS Score: 100 37 www.nbchengfei.com 2->37 39 www.soujson.com 2->39 47 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->47 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 7 other signatures 2->53 11 00928377320212607_pdf.exe 4 2->11         started        signatures3 process4 file5 35 C:\Users\...\00928377320212607_pdf.exe.log, ASCII 11->35 dropped 63 Adds a directory exclusion to Windows Defender 11->63 65 Tries to detect virtualization through RDTSC time measurements 11->65 67 Injects a PE file into a foreign processes 11->67 15 00928377320212607_pdf.exe 11->15         started        18 powershell.exe 25 11->18         started        signatures6 process7 signatures8 69 Modifies the context of a thread in another process (thread injection) 15->69 71 Maps a DLL or memory area into another process 15->71 73 Sample uses process hollowing technique 15->73 75 Queues an APC in another process (thread injection) 15->75 20 explorer.exe 15->20 injected 24 conhost.exe 18->24         started        process9 dnsIp10 41 www.avrenue.com 213.186.33.5, 49738, 80 OVHFR France 20->41 43 www.sjstyles.com 54.38.220.85, 49735, 80 OVHFR France 20->43 45 8 other IPs or domains 20->45 55 System process connects to network (likely due to code injection or exploit) 20->55 26 help.exe 20->26         started        29 autochk.exe 20->29         started        signatures11 process12 signatures13 57 Modifies the context of a thread in another process (thread injection) 26->57 59 Maps a DLL or memory area into another process 26->59 61 Tries to detect virtualization through RDTSC time measurements 26->61 31 cmd.exe 1 26->31         started        process14 process15 33 conhost.exe 31->33         started       
Gathering data
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2021-07-26 13:20:51 UTC
File Type:
PE (.Net Exe)
Extracted files:
59
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cuydekfweudwgfz3mz5vkpnubiddpl4uns6komiecxk3sibsxhzq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
660708a7f99d26de87386ca21682b96179f16f2dbc67578a704cb94d78e9848f
Formbook
9ecedea13dc027095e79edab82e3988f028dfda3ea5b5469351a52a82a60ff7f
Formbook
abb1db77386f0eb3cd2c68603ee8817d6d1015287422182845345dad70503564
Formbook
bf299d24600936c9f0f4da127632a2a28c4f5243c23a87ee11a6a96b4d7727a2
Formbook
c224e597b165da77d8555c2d28901b3526dd5369f0b89b4cd4c798c18a088c16
Formbook
ca47dc0de430b0ff194c3c22b596525bd3444b779fdb7fdc099a30156f737b39
Formbook
ccb857bca12ac7474e7b496a4cc5301cd37a71825f4b9236044ecc7906bd0def
Formbook
dc5f7d89ab2465597ff7fa9f544326613aeaab2afa6e2e457ba5fc0da15bd450
Formbook
eafdb129c8149dd8323fc49907c4897db14aba8c1399ba87a4636281601a2aa7
Formbook
+ 6'812 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat suricata
Link:
https://tria.ge/reports/210726-k785816ra6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
CustAttr .NET packer
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Malware Config
C2 Extraction:
http://www.makarimusic2020.com/uisg/
Unpacked files
SH256 hash:
ba6579c6a4408f2eb899f3743de65000cb834ce5878f666e5c4bce026f931a82
MD5 hash:
956c7ae9486e5095631e4c7f99de68c2
SHA1 hash:
fce11b1bdbe0b282600cf668fb7698fbc1f8c1a1
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/c1eb7232-1703-4b5d-8c85-d733945d85fc/
Parent samples :
c224e597b165da77d8555c2d28901b3526dd5369f0b89b4cd4c798c18a088c16
15303228b6250763173b667b553db40a0637af946cbca7310415d5b92032b9f3
e8287d910fa441a9af68860be6dbeeb6ca4e6e5ee2920f1f2d66775dc7c30b05
e3639a291e120d2ac06f722f0da51fd842cea6469339208ef0ec6e7edf84e310
SH256 hash:
dae3c270095662ca750349f3384479c1ef9f196a74db91a91d3cb598e4a1ec8b
MD5 hash:
133ddfbd2397ee3e7ed602c2223c06c0
SHA1 hash:
d60e91cd0cc20943ba3b057428b505d03b53b2fb
Link:
https://www.unpac.me/results/c1eb7232-1703-4b5d-8c85-d733945d85fc/
SH256 hash:
03456658a751d65243c51ab16306e20da6663e07370068d6f3b2dd5b782d669c
MD5 hash:
9ae9ee0761072a707aa0aaafc2546354
SHA1 hash:
7499e33de43eb83dff3d8b01636d2ec050da3656
Link:
https://www.unpac.me/results/c1eb7232-1703-4b5d-8c85-d733945d85fc/
SH256 hash:
97d2fa1d01b2f9a2199896e05e0cf60c14a9f41ef2d72e15fbb862b7afa08438
MD5 hash:
68463851c0e6fe7a254c99fae763d454
SHA1 hash:
4587a5371d88c296a0184fe47ee0c5245b187127
Link:
https://www.unpac.me/results/c1eb7232-1703-4b5d-8c85-d733945d85fc/
SH256 hash:
15303228b6250763173b667b553db40a0637af946cbca7310415d5b92032b9f3
MD5 hash:
98f9e9a5d39d967b857aabd08a12a944
SHA1 hash:
8c5ee585d13a0165c2896430999838db59a94516
Link:
https://www.unpac.me/results/c1eb7232-1703-4b5d-8c85-d733945d85fc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/15303228b6250763173b667b553db40a0637af946cbca7310415d5b92032b9f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/174133/

Comments