MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1813e0f9ae87ebcdbdd10834c3fa6a57cd3192c62fa4a35e16a201f4c6d48dd7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 20


Intelligence 20 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1813e0f9ae87ebcdbdd10834c3fa6a57cd3192c62fa4a35e16a201f4c6d48dd7
SHA3-384 hash: 6c0f8b6e026d180b84e9f952738dbc070cbd8aacac978d5210bb0e66c84a8cf4d7dbac733b6cf990c4c9a6216be726bb
SHA1 hash: 54465427895b8abb24a34a80e531a461359ddebd
MD5 hash: bffbcc60493f169fb8ff686039a36c27
humanhash: butter-glucose-thirteen-arkansas
File name:60069-PO-13228.pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:693'760 bytes
First seen:2025-03-17 11:08:16 UTC
Last seen:2025-03-17 11:25:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:4Q02HP50QuOgfa5sga3xKbvTGwaR9yxVlzEzgWs357Hn8Rz6Tl5:rHPK6g8sgI8bqwaRQxTzP357sz6Tl
TLSH T10FE4019527B8CF26EE7903F40A30D53447F26D5AE412E34A8EC1F8EB3461B91AB59353
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
430
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
60069-PO-13228.pdf.exe
Verdict:
Malicious activity
Analysis date:
2025-03-17 11:10:29 UTC
Tags:
formbook stealer xloader
Link:
https://app.any.run/tasks/c53d8cb2-1f41-48b1-b4bb-aa1edecb62a2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67d8045208116ce42571bc5e
Tags:
underscore extens shell spawn
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Unauthorized injection to a browser process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/67d802d80a7899f35799907e/reports/c7c36d97-8dcb-4d72-b2f6-a3ebeb3a50dc/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/1813e0f9ae87ebcdbdd10834c3fa6a57cd3192c62fa4a35e16a201f4c6d48dd7
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/40e473e3-43a9-4d4c-a644-cf0931d1cf21
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1640515
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Double Extension File Execution
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1640515 Sample: 60069-PO-13228.pdf.exe Startdate: 17/03/2025 Architecture: WINDOWS Score: 100 38 www.un20250227-23.fun 2->38 40 www.r33bz.online 2->40 42 9 other IPs or domains 2->42 56 Found malware configuration 2->56 58 Malicious sample detected (through community Yara rule) 2->58 60 Multi AV Scanner detection for submitted file 2->60 62 10 other signatures 2->62 11 60069-PO-13228.pdf.exe 4 2->11         started        15 svchost.exe 1 1 2->15         started        signatures3 process4 dnsIp5 36 C:\Users\user\...\60069-PO-13228.pdf.exe.log, ASCII 11->36 dropped 64 Adds a directory exclusion to Windows Defender 11->64 66 Tries to detect virtualization through RDTSC time measurements 11->66 68 Injects a PE file into a foreign processes 11->68 70 Switches to a custom stack to bypass stack traces 11->70 18 60069-PO-13228.pdf.exe 11->18         started        21 powershell.exe 23 11->21         started        44 127.0.0.1 unknown unknown 15->44 file6 signatures7 process8 signatures9 46 Modifies the context of a thread in another process (thread injection) 18->46 48 Maps a DLL or memory area into another process 18->48 50 Sample uses process hollowing technique 18->50 54 2 other signatures 18->54 23 explorer.exe 79 7 18->23 injected 52 Loading BitLocker PowerShell Module 21->52 25 WmiPrvSE.exe 21->25         started        27 conhost.exe 21->27         started        process10 process11 29 chkdsk.exe 23->29         started        signatures12 72 Modifies the context of a thread in another process (thread injection) 29->72 74 Maps a DLL or memory area into another process 29->74 76 Tries to detect virtualization through RDTSC time measurements 29->76 78 Switches to a custom stack to bypass stack traces 29->78 32 cmd.exe 1 29->32         started        process13 process14 34 conhost.exe 32->34         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1813e0f9ae87ebcdbdd10834c3fa6a57cd3192c62fa4a35e16a201f4c6d48dd7
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1813e0f9ae87ebcdbdd10834c3fa6a57cd3192c62fa4a35e16a201f4c6d48dd7/
Threat name:
ByteCode-MSIL.Trojan.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-03-17 09:47:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=daj6b6noq7v43porba2mh6tkk7gtdewgf6skgxqwuia7jrwurxlq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
error
Formbook
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:m13o discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/250317-m86gla1pz8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Deletes itself
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ca1e3f6f-4a8e-4fba-9456-3a58aac87177
Unpacked files
SH256 hash:
1813e0f9ae87ebcdbdd10834c3fa6a57cd3192c62fa4a35e16a201f4c6d48dd7
MD5 hash:
bffbcc60493f169fb8ff686039a36c27
SHA1 hash:
54465427895b8abb24a34a80e531a461359ddebd
Link:
https://www.unpac.me/results/0d1e6d7d-6d2e-4e35-975a-1ee058c2f29b/
SH256 hash:
f60a24b92fae48f6a753e23756e81bc20d4e9ab0ef8ca2c4c1719e5b521bcfe6
MD5 hash:
7b42e6fe0c33a4479d04426e14ce41c5
SHA1 hash:
0ef906c70ecfd6b3b50fa9d7e4824a6bfc12de22
Link:
https://www.unpac.me/results/0d1e6d7d-6d2e-4e35-975a-1ee058c2f29b/
SH256 hash:
5619672f600869df14aa6cd9db4c4c72e6509a4d69a7c42423adf571c23e2ffd
MD5 hash:
de4a3c598a142bb5c3a6c846e08e2eb5
SHA1 hash:
ff1bfc2f4e4c78fc11d3afbfc1e10f09f9c5188e
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/0d1e6d7d-6d2e-4e35-975a-1ee058c2f29b/
SH256 hash:
9bb95fcf7dfd0852612dd070707d64f3d5c07d43a25fa637b8887f831c933bc0
MD5 hash:
8a10c1f7a85da013ae7a70dc499cf59a
SHA1 hash:
b15e28f226cce514e0bcb7457552d21e5a3dcde4
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
FormBook
Create hunting rule
Windows_Trojan_Formbook
Create hunting rule
Formbook
Create hunting rule
Link:
https://www.unpac.me/results/0d1e6d7d-6d2e-4e35-975a-1ee058c2f29b/
Parent samples :
1813e0f9ae87ebcdbdd10834c3fa6a57cd3192c62fa4a35e16a201f4c6d48dd7
97b825e713db39ad07e6dcd7ed37ef80379f2838f8c89df538b942c15c4bfc2a
3fbcec3b7e1d2b8efef9e2ab1be54a55e2252166cd357fc2ee9cb42581851365
439e270481fa6cf85666be16e0f41dcbf80e2515b304573591528a1cfa3d9758
dda1b2cf6d02fd22ce9bdeac8a3a6e6ff669928524a2ec4af673bfe1c75ae690
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1813e0f9ae87/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1813e0f9ae87ebcdbdd10834c3fa6a57cd3192c62fa4a35e16a201f4c6d48dd7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments