MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1b406a68c4eafc78f127b013623b0d64d07b8a586ccd7fc6ebab8254fea0a469. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 11
| SHA256 hash: | 1b406a68c4eafc78f127b013623b0d64d07b8a586ccd7fc6ebab8254fea0a469 |
|---|---|
| SHA3-384 hash: | 28a20fb018976a1be345b07a7fd0621b2fc570475690689d51a0abc9c77cc1912e47950fa930063a8141e539004d448b |
| SHA1 hash: | 9c4a949e4f75dfb07c2334a955ce0cc092363370 |
| MD5 hash: | 58ad74f66fe410ba126fc0a67b75f72e |
| humanhash: | whiskey-finch-idaho-angel |
| File name: | FRA-4181.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 763'392 bytes |
| First seen: | 2023-12-01 14:07:04 UTC |
| Last seen: | 2023-12-01 15:31:38 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 12288:7IW6KczGY5todjJ1VtEjvCIrAmZpKunC5eJvNLqs5yUN:16pSYAjJztWCs3GA1LqF |
| Threatray | 436 similar samples on MalwareBazaar |
| TLSH | T1CDF4F111326CCF03E4BA4FF96852751453FA359E6422F6582DC274CB50E5FE60AB0AEB |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  malwarelabnet |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
311
Origin country :
CAVendor Threat Intelligence
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Launching a process
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-12-01 12:36:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
19
AV detection:
14 of 23 (60.87%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
agenttesla
Similar samples:
+ 426 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Unpacked files
SH256 hash:
e8b224e8084b26bc1900b890cbe4ce8484c21a6f7669f964049e67b25f4825cd
MD5 hash:
296a7928a0a17e9926edc09fde191ed3
SHA1 hash:
278be4202d6de8f75268c35ecee57827258b59d7
SH256 hash:
c516fa6d911a9a818469a610bcfd2e3a080450773353e6fd31ae8868940913b8
MD5 hash:
52f5d2a584aff291656efaf7c0d82fde
SHA1 hash:
33a2667c1de4b9678ca767e326d38bc5a1cd24af
SH256 hash:
bc99dcc182eaf17394c34611c1aef4ad45c3079ae116c19caa17620d64c39f7c
MD5 hash:
84fe0cc42b4f30e7b6f58c92f9ad3d56
SHA1 hash:
d753cc7cc8e2927f9cde57fb67b5bceebd2f5fd2
SH256 hash:
5477a122664afe508f5647e6ee8144322f4242b4953f0cec8509f83fc3c18adb
MD5 hash:
ac229a9af00a4949468d32d363b5510c
SHA1 hash:
cbe00f0983ca45e97caffe1e4fb06c61abb8db70
SH256 hash:
0786ed00256fea03344888a29e0c1d56ee0eb4c92cb033519589cb267008f175
MD5 hash:
fac567b75bcba9f4841ec936fb65fab5
SHA1 hash:
caa384db1599dfd2d35e952ff0ea769b3133af76
SH256 hash:
0e8a5f6bd3e915b9d2fae9428730dc5017348d23b622bccbb1971e352052734b
MD5 hash:
56feb04fdc8b0453c62267ac204ed555
SHA1 hash:
7d41fb41cac90bea85cb6691a5945568115cbcbf
SH256 hash:
1b406a68c4eafc78f127b013623b0d64d07b8a586ccd7fc6ebab8254fea0a469
MD5 hash:
58ad74f66fe410ba126fc0a67b75f72e
SHA1 hash:
9c4a949e4f75dfb07c2334a955ce0cc092363370
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AgentTesla_DIFF_Common_Strings_01 |
|---|---|
| Author: | schmidtsz |
| Description: | Identify partial Agent Tesla strings |
| Rule name: | DebuggerCheck__GlobalFlags |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Active |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Thread |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | Formbook |
|---|---|
| Author: | kevoreilly |
| Description: | Formbook Payload |
| Rule name: | maldoc_find_kernel32_base_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | maldoc_getEIP_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Windows_Trojan_Formbook |
|---|---|
| Author: | @malgamy12 |
| Rule name: | Windows_Trojan_Formbook_1112e116 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_formbook_w0 |
|---|---|
| Author: | @malgamy12 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.