MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d2e838ebd5c4e029e1887a25623fc05daf45ea26343c5ce7f568aea81672d9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1d2e838ebd5c4e029e1887a25623fc05daf45ea26343c5ce7f568aea81672d9a
SHA3-384 hash: 04716280b9ec273359febddf8403fdb3263d181f9e80bde5b71c46c796ea0a7c7e42f0a63c34021b178549d0b43383aa
SHA1 hash: 02e16e30566bf9da4839e1e419814452c03046cf
MD5 hash: 371968aa95ae5c9df81e41dbb5958d11
humanhash: moon-dakota-wolfram-blue
File name:DHL Notification_pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:409'778 bytes
First seen:2023-04-25 15:38:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep 12288:sYi8+0TZiKh8AI+AzZo1ehWUT/q9Be8q/a6:sY20TZiKO0AQehW4qjq/X
Threatray 2'718 similar samples on MalwareBazaar
TLSH T1F194E04944F98CEAE179C4720C64F99E36537C0A8C255F865E23F899E8335D226B3E1F
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 62ceaea6b2969eaa (14 x Formbook, 1 x AgentTesla)
Reporter abuse_ch
Tags:DHL exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
252
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/384857/
Detection(s):
Sanesecurity.Malware.28885.BadCo.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/81424/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo nemesis overlay packed remcos shell32.dll
Link:
https://www.filescan.io/uploads/6447f41832d814bb2259c680/reports/ad83f2ac-488b-4110-ae5f-11f4530d5cd6/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/1d2e838ebd5c4e029e1887a25623fc05daf45ea26343c5ce7f568aea81672d9a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2de23b72-928b-47e4-becd-8b1fa2cc09ce
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1220867
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1d2e838ebd5c4e029e1887a25623fc05daf45ea26343c5ce7f568aea81672d9a/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2023-04-25 10:54:50 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
18 of 37 (48.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=duxihdv5lrhafhqyq6rfmi74axnpixvcmnb4ltt7k2fovalhfwna._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0e83b40d751f735b6088f7c998ed7dd3321527adecf03ad156d91120adccd9eb
Formbook
142f8b22d894f1fee4c501acbc425edec276004d5d30ab7572cdfab85e89ad12
Formbook
27092cac933ddf8f3790ad2cfdd8bb8ffa80adec09f96f4acb2b3ee24ee2157e
Formbook
3af2c0904f3729e0408f6479f4222d5fbcf695f2b5cd32e8737e8690661bb18b
Formbook
492cabb55a2f649ce32194e8f9737a51f071b370bc9cd527aa8cd0b844ee7ea8
Formbook
652948efee89fdc5c6d3dc7f65a16aafabd0d224c9fcd55e5f86573f1b2c4aa1
Formbook
95086b275ae58d917c7f5d10b0d74ed4a1997c2b4d6bb3889c01075fe63b7800
Formbook
b6fe7602e8f288c48cf04e60306dc9349c5b9ebeb8faf35905abede7d0525480
Formbook
b9fb6cc26328ecd1dfcd7f7296d3a5da0bbf305bbe86484aebc0a03c7162e876
Formbook
c4ab14d93e54b2c6e70fa0f284cee729b56186894dfdff4207cbc3d0c690c80f
Formbook
+ 2'708 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230425-s3lswsbb74/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
c0fe387fa5921803088adae11d6cef7c576b0b5115bc0ef74f341dfc2e50dd02
MD5 hash:
4bd8787444f3770df0e2efa7417a2c9d
SHA1 hash:
58a527e1437e92be97cd60c6617fe89fe98e035a
Link:
https://www.unpac.me/results/1c878e82-e5ab-4dd7-a1fc-950870153cdb/
SH256 hash:
1b4e6fe52290b005c1024d2f1e119c71ed0869d816d78f4fff4355836aaa2322
MD5 hash:
d0d41c4b00be0731fe282adb38c98e6e
SHA1 hash:
3920e51b9c5d6238f3458edacfb562a5919c1e00
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/1c878e82-e5ab-4dd7-a1fc-950870153cdb/
Parent samples :
95086b275ae58d917c7f5d10b0d74ed4a1997c2b4d6bb3889c01075fe63b7800
e6da88a872c8469905267a47cd97abf35d2f8eba35793e137ae40b0ffff4a9f4
06aef7984e235a2877ea9fa1ac04b96104f8caa5b2a4fe61ef1ec98077f40567
2ef75197721efedf4bb9e71f77cf6feab3029ec28035016c91d6734b9c1effdf
1d2e838ebd5c4e029e1887a25623fc05daf45ea26343c5ce7f568aea81672d9a
SH256 hash:
1d34b9015a8869bf481414145ee33873ccb77db598d75bc4132834b2571045c1
MD5 hash:
4baee9382b7dadf1f6f92461da6b9e84
SHA1 hash:
2eaf7b3d5c07469b66b311e519985d4dd9621cd9
Link:
https://www.unpac.me/results/1c878e82-e5ab-4dd7-a1fc-950870153cdb/
SH256 hash:
1d2e838ebd5c4e029e1887a25623fc05daf45ea26343c5ce7f568aea81672d9a
MD5 hash:
371968aa95ae5c9df81e41dbb5958d11
SHA1 hash:
02e16e30566bf9da4839e1e419814452c03046cf
Link:
https://www.unpac.me/results/1c878e82-e5ab-4dd7-a1fc-950870153cdb/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1d2e838ebd5c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1d2e838ebd5c4e029e1887a25623fc05daf45ea26343c5ce7f568aea81672d9a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.formbook.
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/384857/

Comments