MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1910086de9f1a5a56200a9936bbed7b5c80f9fc6a2c6612a0073bc0c9ba54861. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1910086de9f1a5a56200a9936bbed7b5c80f9fc6a2c6612a0073bc0c9ba54861
SHA3-384 hash: 4ac0f55f37568a2f40daa0abaca7c075a4a2bb2f1608a6c6b7653f2c7b56f39b6344cc1181a591c6a213c488ce07048a
SHA1 hash: 04b4812819f136d2f8039c11e7b21525b4f70dab
MD5 hash: b650c148a6538bb45b57ba21d049dec7
humanhash: lactose-violet-pluto-steak
File name:SHIPPING DOCUMENTS.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:565'889 bytes
First seen:2021-08-04 08:24:57 UTC
Last seen:2021-08-04 09:01:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 97750a00050e37c7b56da7bc3864f0f1 (7 x Formbook, 2 x Loki, 1 x RedLineStealer)
ssdeep 12288:chQVh9a17gNm5YnXDdx2OjKhNHySntnXjBMrpXqgfRuOK1tdsl1R9:chQVh9FDdx2GKzSStTy8gytwx
Threatray 7'342 similar samples on MalwareBazaar
TLSH T19AC4BF11BD818036C27238314679E3B249BD68702E209F9F67D82979AF345D1B636B7F
dhash icon b69292b2ca8ca49b (4 x SnakeKeylogger, 2 x Formbook, 1 x Phorpiex)
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
187
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SHIPPING DOCUMENTS.exe
Verdict:
Malicious activity
Analysis date:
2021-08-04 08:27:50 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/aef49be0-6de7-4bc1-a2f7-07b00175334c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/176263/
Detection(s):
SecuriteInfo.com.Trojan.Siggen14.53796.13440.30159.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/14a94adb-96a5-4774-89c5-d047a31d222f
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/826718
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 459149 Sample: SHIPPING DOCUMENTS.exe Startdate: 04/08/2021 Architecture: WINDOWS Score: 100 31 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->31 33 Found malware configuration 2->33 35 Malicious sample detected (through community Yara rule) 2->35 37 7 other signatures 2->37 9 SHIPPING DOCUMENTS.exe 2->9         started        process3 signatures4 39 Maps a DLL or memory area into another process 9->39 12 SHIPPING DOCUMENTS.exe 9->12         started        process5 signatures6 41 Modifies the context of a thread in another process (thread injection) 12->41 43 Maps a DLL or memory area into another process 12->43 45 Sample uses process hollowing technique 12->45 47 Queues an APC in another process (thread injection) 12->47 15 help.exe 12->15         started        18 explorer.exe 12->18 injected process7 dnsIp8 49 Modifies the context of a thread in another process (thread injection) 15->49 51 Maps a DLL or memory area into another process 15->51 53 Tries to detect virtualization through RDTSC time measurements 15->53 21 cmd.exe 1 15->21         started        25 www.metalloobrabotka.info 185.165.123.36, 49747, 80 VARITI-ASRU Russian Federation 18->25 27 streamzone300.xyz 63.143.57.84, 49750, 80 LIMESTONENETWORKSUS United States 18->27 29 21 other IPs or domains 18->29 55 System process connects to network (likely due to code injection or exploit) 18->55 57 Performs DNS queries to domains with low reputation 18->57 signatures9 process10 process11 23 conhost.exe 21->23         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1910086de9f1a5a56200a9936bbed7b5c80f9fc6a2c6612a0073bc0c9ba54861/
Threat name:
Win32.Ransomware.Cryptor
Create hunting rule
Status:
Malicious
First seen:
2021-08-04 07:02:44 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=deiaq3pj6gs2kyqavgjwxpwxwxea7h6guldgckqaoo6azg5fjbqq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
108cc18c30a306c9fcd29d6d587cee73e18ccabbda0cb669b513a22b300d3a1d
Formbook
14854d1ce96dcc9795941ec7248f8d2481d5649cdeecaccbfe840f259bc50bde
Formbook
355dd96121c1930f9c9c0f94b6474d5cbeb3bcfd6a7c51a043674cc79a26c891
Formbook
3e23bf4937349c5f5cf233e30658562fca94d58790ebbe693e176fb595fb0b34
Formbook
3f9a8485314c2b666caf0a1a729a96cb974780f331ea9baa0c03e7f02035cf05
Formbook
6f1507120710fd267c7d2b6aa1d63cec192e4eb904675f260a8e2e18ebfc4b99
Formbook
7e5cbd1d9fa1eab91099fcf24c569ce8e14fdcdc1f4f345d47ffdb5270c9312c
Formbook
9ce9e41c146be2b9aecbed6e14d9c4fa9d69d6b51038ba27782d08a432c8c95d
Formbook
bb9ba507dcfe191724f459ded8009edfa46481b2e244827354116f1734a52a9c
Formbook
+ 7'332 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat suricata
Link:
https://tria.ge/reports/210804-p2218p82gj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Malware Config
C2 Extraction:
http://www.shiveringcactus.net/cre4/
Unpacked files
SH256 hash:
2fb4110bc8ebb2e442a362554f88fe6a1d5d3e77e48f89cac68bb8784bbbadb3
MD5 hash:
32617a169c6235eeb6cb6aa62b613998
SHA1 hash:
eebab7344d6f4f52e4942711ec6e601d68130a54
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/963bdab0-aab8-4201-9e14-c68e405d4f4b/
Parent samples :
6f1507120710fd267c7d2b6aa1d63cec192e4eb904675f260a8e2e18ebfc4b99
1910086de9f1a5a56200a9936bbed7b5c80f9fc6a2c6612a0073bc0c9ba54861
ba852a2b1acc3b7c2bb98e6acbe41948de4e8046bbf6c3a874d7462f23d19f1e
2dc07dd1ba98f6df9c4eb8c62a01a40217ec2f3982e3d362dd20b54c77c0417e
SH256 hash:
1910086de9f1a5a56200a9936bbed7b5c80f9fc6a2c6612a0073bc0c9ba54861
MD5 hash:
b650c148a6538bb45b57ba21d049dec7
SHA1 hash:
04b4812819f136d2f8039c11e7b21525b4f70dab
Link:
https://www.unpac.me/results/963bdab0-aab8-4201-9e14-c68e405d4f4b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1910086de9f1a5a56200a9936bbed7b5c80f9fc6a2c6612a0073bc0c9ba54861

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 1910086de9f1a5a56200a9936bbed7b5c80f9fc6a2c6612a0073bc0c9ba54861

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/176263/

Comments