MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a52416bc054c0f2a46f2fd215d73d3285334fcdacf02ed449935bd93fb70863. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 20


Intelligence 20 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a52416bc054c0f2a46f2fd215d73d3285334fcdacf02ed449935bd93fb70863
SHA3-384 hash: 70e0bab02e29538d50a6f065851bdf859562e3e0753281ac44c979d7a77c1a624f1ee9cf9accfab2aa36b926f4faa1ca
SHA1 hash: a7c12eef84ae778ce5158327d419508eb5b199c8
MD5 hash: 6e39ee33f6527364cac3cc4bbf276f26
humanhash: shade-xray-montana-robin
File name:Quotation #10091.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:776'791 bytes
First seen:2024-09-24 13:01:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 890e522b31701e079a367b89393329e6 (25 x Formbook, 12 x AgentTesla, 8 x Loda)
ssdeep 12288:v6Wq4aaE6KwyF5L0Y2D1PqLVRX3OyQsAhJYUVTx6AflSeqz2jqPB88bYVUCYH5g:tthEVaPqL7nvQlhJYATxDYeHjqPB88ZO
Threatray 942 similar samples on MalwareBazaar
TLSH T15DF423CE76FDAC00E4D826FABA824280C1902418DB7D963B71246E7F5E7B109459BD7F
TrID 86.7% (.EXE) AutoIt3 compiled script executable (510622/80/67)
4.5% (.EXE) UPX compressed Win32 Executable (27066/9/6)
4.5% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
1.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
0.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
File icon (PE):PE icon
dhash icon b150b26869b2d471 (468 x Formbook, 101 x RedLineStealer, 94 x AgentTesla)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
409
Origin country :
US US
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
Quotation #10091.exe
Verdict:
Malicious activity
Analysis date:
2024-09-24 13:02:30 UTC
Tags:
upx autoit formbook xloader
Link:
https://app.any.run/tasks/f9675e97-1ede-41c3-bb99-489ae9335e48

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.PSW.Banker6.BTQY.1690.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66f2b84c5346c7b922ada887
Tags:
Encryption Network Stealth Swotter Shellcode Exploit Tori
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
autoit lolbin microsoft_visual_cc overlay packed packed packed shell32 upx
Link:
https://www.filescan.io/uploads/66f2b84d5551d52611ffd98a/reports/5d1c19ea-206d-4153-a26a-ca30a25b11dd/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/1a52416bc054c0f2a46f2fd215d73d3285334fcdacf02ed449935bd93fb70863
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a0af3ff7-0e78-46ab-918e-e50635e685c7
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1516749
Signature
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Tries to resolve many domain names, but no domain seems valid
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1516749 Sample: Quotation #10091.exe Startdate: 24/09/2024 Architecture: WINDOWS Score: 100 30 www.oldensky10.xyz 2->30 32 www.trustcapital247.online 2->32 34 9 other IPs or domains 2->34 38 Suricata IDS alerts for network traffic 2->38 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 46 9 other signatures 2->46 11 Quotation #10091.exe 1 2->11         started        signatures3 44 Performs DNS queries to domains with low reputation 30->44 process4 signatures5 56 Writes to foreign memory regions 11->56 58 Maps a DLL or memory area into another process 11->58 14 svchost.exe 11->14         started        process6 signatures7 60 Modifies the context of a thread in another process (thread injection) 14->60 62 Maps a DLL or memory area into another process 14->62 64 Sample uses process hollowing technique 14->64 66 3 other signatures 14->66 17 explorer.exe 67 1 14->17 injected process8 dnsIp9 28 www.igmoto.info 89.31.143.90, 49704, 80 QSC-AG-IPXDE Germany 17->28 36 System process connects to network (likely due to code injection or exploit) 17->36 21 help.exe 17->21         started        signatures10 process11 signatures12 48 Modifies the context of a thread in another process (thread injection) 21->48 50 Maps a DLL or memory area into another process 21->50 52 Tries to detect virtualization through RDTSC time measurements 21->52 54 Switches to a custom stack to bypass stack traces 21->54 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1a52416bc054c0f2a46f2fd215d73d3285334fcdacf02ed449935bd93fb70863
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1a52416bc054c0f2a46f2fd215d73d3285334fcdacf02ed449935bd93fb70863/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2024-09-24 03:52:50 UTC
File Type:
PE (Exe)
Extracted files:
54
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=djjec26aktapfjdpf7jblvz5gkctgt6nvtyc5vcjsnn5sp5xbbrq._file
Verdict:
malicious
Label(s):
admintool_powerrun
Create hunting rule
Similar samples:
00973673a54cfd2a206c7695fa86077d1a1803629d7207b1e5fb295255a25ae2
Formbook
8a4f3f97105ed3e4700a34f71fa7f6a8cd6be9479cfba9f79cdd08cb112f62ef
Formbook
8d83a9a3bbd6e63e37b6d66c4febdbcf17a48fe77fabdd52c5bfa01a661a33da
Formbook
b3647d36c291bd8ab5907166f15e003ee34e07221fde3665611a142a13dca393
Formbook
ca690123d14bd3632ab53a076f8bfb7bd2176248af6b735af9719aca77a024b5
Formbook
e5aebbb2c6ad445d5a2ee5c33a77d8ecfe74cf206433b723736e2e88b9b5d78f
Formbook
+ 932 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:c89p discovery rat spyware stealer trojan upx
Link:
https://tria.ge/reports/240924-p9scgawbpj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Formbook payload
Formbook
Verdict:
Suspicious
Tags:
trojan
YARA:
MAL_Malware_Imphash_Mar23_1
Link:
https://app.threat.zone/submission/f885995f-1a6a-4029-ac1b-3d659e6356c8
Unpacked files
SH256 hash:
9882e205ccb6e1a05b0c19b5c3bc82945b789a265f0932a5aa129e1bd4639161
MD5 hash:
33cbd92131f8735d23eb84a33db1fc05
SHA1 hash:
a1c55458d991ebec56eb5f9cf369edf98d92bce8
Detections:
FormBook
Create hunting rule
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_w0
Create hunting rule
Formbook
Create hunting rule
Link:
https://www.unpac.me/results/9043b5ad-704c-492b-acb7-13058987e003/
Parent samples :
1dab7f07bfa344e601226bc0657decbabd3b421fd207e031ae99ccfbc5637414
8d83a9a3bbd6e63e37b6d66c4febdbcf17a48fe77fabdd52c5bfa01a661a33da
ede8ae39d91066365f959fc9c98f0b47add88604ce95829a9618a15274faef3f
86f8d817d26e2a9566ac4500033855f9b17e50ad4276b9d488acbc53894edd91
1a52416bc054c0f2a46f2fd215d73d3285334fcdacf02ed449935bd93fb70863
36421bdf90ea83d4e677a54710f4d35e2bc15a1222c4abb17e78996029f53c97
04cc97f6c5e790280083938432502b46d3955489b710e6ba66ba2fb98b9e76db
ebddd04d90d5317ac06e4a5515143c6b130a45d2c328c115f3ee37d1eb665c0c
06d709cf438f3fefe0ed7858278e77e1188422e2b4d59706f6c4759df1a5aafd
732336eccda1e0e01a9474a968eb6ac9725fec8e8e03ad950472df75ba470693
1dc4c4881f138a6f1ffae6b406e696a46a89f3a0d1265a5ec6ed3d80dc40ea32
SH256 hash:
a1c96dafa65b5ecb3a425fd6cb696aadf00fb6a3a6c3dd30b27b5e7ae8f171d0
MD5 hash:
81ae4e297ec03bb71a256e7bfe857ae9
SHA1 hash:
bd3a362542330a92d73441c4e21614f329714e9f
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/9043b5ad-704c-492b-acb7-13058987e003/
SH256 hash:
1a52416bc054c0f2a46f2fd215d73d3285334fcdacf02ed449935bd93fb70863
MD5 hash:
6e39ee33f6527364cac3cc4bbf276f26
SHA1 hash:
a7c12eef84ae778ce5158327d419508eb5b199c8
Detections:
MAL_Malware_Imphash_Mar23_1
Create hunting rule
Link:
https://www.unpac.me/results/9043b5ad-704c-492b-acb7-13058987e003/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1a52416bc054/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1a52416bc054c0f2a46f2fd215d73d3285334fcdacf02ed449935bd93fb70863

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXv20MarkusLaszloReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 1a52416bc054c0f2a46f2fd215d73d3285334fcdacf02ed449935bd93fb70863

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetAce
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA

Comments