MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18cc402054f5c3b2abe9fc659dae16c9757312a9c9d7f4b614909b6bd97ff39f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18cc402054f5c3b2abe9fc659dae16c9757312a9c9d7f4b614909b6bd97ff39f
SHA3-384 hash: 7739f3e7c7e7413c7765ce9e7cbcffbc033f76222137bb5dfcdfb94c96a5ee561fc50c5f8fe9b755ac39432a83d4784b
SHA1 hash: dc908e00261778f5a3cd2fdfe1cf6f57e08ff262
MD5 hash: 563a37681c9b46fba92f4c9432233d5a
humanhash: indigo-earth-triple-sad
File name:new order pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:641'024 bytes
First seen:2025-02-26 09:09:29 UTC
Last seen:2025-03-10 11:51:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:NrgGP8DcJ3h4JKTlOudOI/yuPM92jnfNWO9xDIBybkPMMrbI:NT8QJReahdOILP0gnfN39xDGbPVb
Threatray 4'786 similar samples on MalwareBazaar
TLSH T1CAD401142A19E413CE91A7780A72F2B917781FDE9410D3279FDDBEFBB5B6B160D04282
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter TeamDreier
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
5
# of downloads :
467
Origin country :
DK DK
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
neworderpdf.exe
Verdict:
Malicious activity
Analysis date:
2025-02-25 18:53:01 UTC
Tags:
formbook stealer xloader
Link:
https://app.any.run/tasks/a1ebc66c-0453-448f-bf7e-c6f02e91b958

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3148.13352.21849.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67beda97a0fd713c335ceaea
Tags:
underscore extens shell spawn
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Creating a file
Launching cmd.exe command interpreter
Setting browser functions hooks
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Unauthorized injection to a system process
Unauthorized injection to a browser process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade obfuscated obfuscated packed packed packer_detected phishing vbnet
Link:
https://www.filescan.io/uploads/67beda813afc3763bec771db/reports/8cc0a8e7-4788-4802-b789-b366de8c0044/overview
Verdict:
Malicious
Labled as:
Genie8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/18cc402054f5c3b2abe9fc659dae16c9757312a9c9d7f4b614909b6bd97ff39f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/27fd6b8b-035b-4685-bab7-62451c15ab88
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1624497
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Scheduled temp file as task from temp location
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1624497 Sample: new order pdf.exe Startdate: 26/02/2025 Architecture: WINDOWS Score: 100 71 www.ravessia.tech 2->71 73 www.kzkasaza.cfd 2->73 75 5 other IPs or domains 2->75 89 Found malware configuration 2->89 91 Malicious sample detected (through community Yara rule) 2->91 93 Antivirus / Scanner detection for submitted sample 2->93 95 11 other signatures 2->95 11 new order pdf.exe 7 2->11         started        15 RhthrTZZVZE.exe 5 2->15         started        signatures3 process4 file5 61 C:\Users\user\AppData\...\RhthrTZZVZE.exe, PE32 11->61 dropped 63 C:\Users\...\RhthrTZZVZE.exe:Zone.Identifier, ASCII 11->63 dropped 65 C:\Users\user\AppData\Local\...\tmpD1E5.tmp, XML 11->65 dropped 67 C:\Users\user\...\new order pdf.exe.log, ASCII 11->67 dropped 105 Writes to foreign memory regions 11->105 107 Allocates memory in foreign processes 11->107 109 Adds a directory exclusion to Windows Defender 11->109 17 RegSvcs.exe 11->17         started        20 powershell.exe 23 11->20         started        22 schtasks.exe 1 11->22         started        111 Antivirus detection for dropped file 15->111 113 Multi AV Scanner detection for dropped file 15->113 115 Injects a PE file into a foreign processes 15->115 24 RegSvcs.exe 15->24         started        26 schtasks.exe 1 15->26         started        signatures6 process7 signatures8 77 Modifies the context of a thread in another process (thread injection) 17->77 79 Maps a DLL or memory area into another process 17->79 81 Sample uses process hollowing technique 17->81 87 2 other signatures 17->87 28 explorer.exe 26 1 17->28 injected 83 Loading BitLocker PowerShell Module 20->83 30 WmiPrvSE.exe 20->30         started        32 conhost.exe 20->32         started        34 conhost.exe 22->34         started        85 Found direct / indirect Syscall (likely to bypass EDR) 24->85 36 conhost.exe 26->36         started        process9 process10 38 chkdsk.exe 28->38         started        41 cmd.exe 28->41         started        43 WerFault.exe 28->43         started        signatures11 97 Modifies the context of a thread in another process (thread injection) 38->97 99 Maps a DLL or memory area into another process 38->99 101 Tries to detect virtualization through RDTSC time measurements 38->101 103 Switches to a custom stack to bypass stack traces 38->103 45 explorer.exe 38->45         started        48 explorer.exe 38->48         started        51 explorer.exe 38->51         started        53 cmd.exe 1 38->53         started        process12 dnsIp13 117 System process connects to network (likely due to code injection or exploit) 45->117 119 Query firmware table information (likely to detect VMs) 45->119 69 a-0003.a-msedge.net 204.79.197.203, 443, 49991, 49992 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 48->69 55 WerFault.exe 48->55         started        57 WerFault.exe 51->57         started        59 conhost.exe 53->59         started        signatures14 process15
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/18cc402054f5c3b2abe9fc659dae16c9757312a9c9d7f4b614909b6bd97ff39f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18cc402054f5c3b2abe9fc659dae16c9757312a9c9d7f4b614909b6bd97ff39f/
Threat name:
ByteCode-MSIL.Infostealer.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2025-02-26 09:10:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ddgeaicu6xb3fk7j7rsz3lqwzf2xgevjzhl7jnquscnwxwl76opq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
unknown_loader_037
Create hunting rule
Similar samples:
4b50c23f9c20e569699daba5b9f13a3f5e7e3b9977e38b105aff0c8b18fcba70
Formbook
8209a6f8283a09d52c15681a35047db39b499d081f8c843119252b4c72961c4f
Formbook
8d68ad78eb364b147233b29bbeab6309a47289090ca2672e90fb299a37111f62
Formbook
cb122b2022fcde8c2f1704ac186a0add17028456d867be7fed22e4244bca4a64
Formbook
error
Formbook
f30297ce3c8bc97f49286ee0c14b241d6653a2e992de11213aa25a296ab485cd
Formbook
+ 4'776 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:k15k discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/250226-k45cmatnv3/
Behaviour
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1d24c841-5d75-4a1c-87a5-2109820a31fe
Unpacked files
SH256 hash:
18cc402054f5c3b2abe9fc659dae16c9757312a9c9d7f4b614909b6bd97ff39f
MD5 hash:
563a37681c9b46fba92f4c9432233d5a
SHA1 hash:
dc908e00261778f5a3cd2fdfe1cf6f57e08ff262
Link:
https://www.unpac.me/results/025af5f9-2474-4934-aeff-b08083134009/
SH256 hash:
e80a463e16b14b43e4112cb8f0cb0cf44ff245be592202042373a02b9ea4deb9
MD5 hash:
bbea1aafd0d7058f6f46c8ceff355f96
SHA1 hash:
14ca07073c0a943129823d6532358a55761a203f
Link:
https://www.unpac.me/results/025af5f9-2474-4934-aeff-b08083134009/
SH256 hash:
5f21743dec38e3e546f80e31ed4a18b8502285cc047937302e4056c9667e3572
MD5 hash:
7f8c6ea689fdeb66414294530f1af769
SHA1 hash:
21945bde258966570e6368d76060d0f6a8381e8c
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/025af5f9-2474-4934-aeff-b08083134009/
SH256 hash:
5c6edee104ce0b755ef4bd8adabe909ff4777d437d27e52312a79e9d955617e9
MD5 hash:
1ee9ab6f7d522dcb0650c0c89c103446
SHA1 hash:
c8da1198b7c90bb84e0923943697a8482108bf16
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_w0
Create hunting rule
FormBook
Create hunting rule
Windows_Trojan_Formbook
Create hunting rule
Formbook
Create hunting rule
Link:
https://www.unpac.me/results/025af5f9-2474-4934-aeff-b08083134009/
Parent samples :
18cc402054f5c3b2abe9fc659dae16c9757312a9c9d7f4b614909b6bd97ff39f
6d5aba91499c078d24d86e443d84dd17530fa6ff8535b4d866d26a8578a2ddca
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:crime_win32_ransom_avaddon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Avaddon ransomware
Reference:https://twitter.com/VK_Intel/status/1300944441390370819
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 18cc402054f5c3b2abe9fc659dae16c9757312a9c9d7f4b614909b6bd97ff39f

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments