MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 181c961adb5e3152a9384f18a7fecdc0574a311640434b1a98b3b514311ed645. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | 181c961adb5e3152a9384f18a7fecdc0574a311640434b1a98b3b514311ed645 |
|---|---|
| SHA3-384 hash: | f72519271c2d2a20e5e6a4c52463efd920ef3d4885434c1059cd2214a47dd3e812235bcb21656cdbb5f122c929e1175e |
| SHA1 hash: | 6bcf9afc3b689732376dd8a276173f5a0cc7cdb9 |
| MD5 hash: | e8a910cfaff49b29e0a26ef127c79137 |
| humanhash: | jupiter-montana-item-early |
| File name: | rNJnNhNnN877.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 794'624 bytes |
| First seen: | 2023-08-01 10:57:10 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:n7xF8Mvg3VIS48cc3eCWdK31HovvhBe1sYgcpBTve/xhvByh1Md9cwg:3yVIS4SVRxAwE9 |
| Threatray | 3'454 similar samples on MalwareBazaar |
| TLSH | T114F4FE2939AA500DB3729E556BFCB5B6D05EF6F226364C7B0DF7020620129F0DB9C53A |
| TrID | 28.5% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 13.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 12.2% (.EXE) Win32 Executable (generic) (4505/5/1) 5.6% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Reporter |  FXOLabs |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
285
Origin country :
BRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Our Company is in need of your product(RFQ11090023).eml
Verdict:
Malicious activity
Analysis date:
2023-08-01 04:18:27 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Launching a process
Creating a file
Сreating synchronization primitives
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
confuserex lolbin packed packed replace
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Signature
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.FormBook
Status:
Malicious
First seen:
2023-08-01 00:43:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
22 of 24 (91.67%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 3'444 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
b27d346c4dd2864616a99b737bb0122a7582123d2a4bead31073acdde0985223
MD5 hash:
7f7cbd12c752b4836f4aa87f3abeffd0
SHA1 hash:
ed89b55e3f7925cca185bedad1811f30938ae782
Detections:
XLoader
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
2bb9e8d67b2f3e0cf7db103ceb69ad38922042a409af5b3062c6d605e14cb717
MD5 hash:
582cff42bc257f5baaa2ed2970e4a12c
SHA1 hash:
4d8e8dd77e5a1956155e44972fbb3a4b0cae4c02
SH256 hash:
f8fdc0c6ce42aed3a2a46809d9a458d0c22a88757df1c2fabca6f75704874cdc
MD5 hash:
897ea2bcfcc78408e4beea68b3be622a
SHA1 hash:
d1d73205372f82f286461797c707ead6468be94a
SH256 hash:
181c961adb5e3152a9384f18a7fecdc0574a311640434b1a98b3b514311ed645
MD5 hash:
e8a910cfaff49b29e0a26ef127c79137
SHA1 hash:
6bcf9afc3b689732376dd8a276173f5a0cc7cdb9
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_EXE_Packed_ConfuserEx |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with ConfuserEx Mod |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | pe_imphash |
|---|
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Windows_Trojan_Formbook |
|---|---|
| Author: | @malgamy12 |
| Rule name: | Windows_Trojan_Formbook_1112e116 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_formbook_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.formbook. |
| Rule name: | win_formbook_w0 |
|---|---|
| Author: | @malgamy12 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.