MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e355982ed461419460ecc7c0963264aef160c61cd4bc5ee42a15fa92fe1f4db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e355982ed461419460ecc7c0963264aef160c61cd4bc5ee42a15fa92fe1f4db
SHA3-384 hash: d337eb68727f31faf2acd05a7bc3eb4e6e1ae1211c1f96b360c8cfec5710af2fceba49e171e7cc6adbc2f2ec04f023ed
SHA1 hash: 26339538ebbf7ddb9268229c61babaa4e068827d
MD5 hash: 2f43d372b3a9011ece6307fb5d9d4c35
humanhash: green-zebra-echo-white
File name:HBL.r15
Download: download sample
Signature Formbook
Create hunting rule
File size:268'188 bytes
First seen:2023-07-19 12:03:07 UTC
Last seen:2023-07-20 09:59:53 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:GLJsI6Sf8mwHGAWmjrLqbeQRemhrTUGqbEl6V99nSqusoGwtq8:GVuGAWISiY1htq4Ynjuso/J
TLSH T1AC44233925B6A8849AF2C769CDA88F1B8468F61C5DD074BDDE391CCD0EB935E8C3548C
TrID 58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1)
41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook r15 rar Shipping


Avatar
cocaman
Malicious email (T1566.001)
From: "Jungmi Kim <finance_my@unigreating.com.cn>" (likely spoofed)
Received: "from unigreating.com.cn (unknown [185.222.58.232]) "
Date: "19 Jul 2023 16:00:34 +0200"
Subject: "RE: [Shipping advice] // /BUSAN-NHAVA SHEVA // JI TECH"
Attachment: "HBL.r15"

Intelligence

File Origin
# of uploads :
4
# of downloads :
112
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:HBL.exe
File size:284'031 bytes
SHA256 hash: c433841d01e8b7901e45455592fd6db08dd48b4caf2682d3222078018475de60
MD5 hash: f3623fd8b9446e301b0d1bd390ef841e
MIME type:application/x-dosexec
Signature Formbook
Vendor Threat Intelligence
Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/1e355982ed461419460ecc7c0963264aef160c61cd4bc5ee42a15fa92fe1f4db/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/64b7d133fd9e198dc1160ee3/reports/6ee4c2ec-02ac-4dd8-bc02-5e6e576bce11/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/1e355982ed461419460ecc7c0963264aef160c61cd4bc5ee42a15fa92fe1f4db
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1e355982ed461419460ecc7c0963264aef160c61cd4bc5ee42a15fa92fe1f4db/
Threat name:
Win32.Trojan.Nsisx
Create hunting rule
Status:
Malicious
First seen:
2023-07-19 09:21:19 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dy2vtaxniykbsrqozr6asyzgjlxrmddbzvf4l3scufp2sl7b6tnq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/230719-pg7axseh6w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1e355982ed461419460ecc7c0963264aef160c61cd4bc5ee42a15fa92fe1f4db

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.formbook.
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 1e355982ed461419460ecc7c0963264aef160c61cd4bc5ee42a15fa92fe1f4db

(this sample)

Formbook

Executable exe c433841d01e8b7901e45455592fd6db08dd48b4caf2682d3222078018475de60

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c433841d01e8b7901e45455592fd6db08dd48b4caf2682d3222078018475de60
  
Dropping
Formbook
  
Dropping
MD5 f3623fd8b9446e301b0d1bd390ef841e

Comments