MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f50bdf74a64aac8ae53532f8c66fa2a521442913ed0cb7b0306aa64dae33027. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f50bdf74a64aac8ae53532f8c66fa2a521442913ed0cb7b0306aa64dae33027
SHA3-384 hash: 1a161bbc6813ca1a6094d7d81c6789d76860a3fe8041f890f07fd9ef1d67513ec9e56c9564e96a254afb91ebd4b4cb75
SHA1 hash: 7b1d695c83acc38ece1844bb337f627a183e5de1
MD5 hash: 499dff4ed765de8f503bbce011370996
humanhash: floor-robin-snake-uncle
File name:1f50bdf74a64aac8ae53532f8c66fa2a521442913ed0cb7b0306aa64dae33027
Download: download sample
Signature Formbook
Create hunting rule
File size:187'392 bytes
First seen:2023-05-05 11:26:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:mIuDZjDrzvQCPIeDi2tFF317rVjXgwvUoNmLBKDafxl7MKgmKjPhepEHRGShlDC4:VqzvHPIeDis3JXluosojPLxNhliSK
Threatray 2'740 similar samples on MalwareBazaar
TLSH T152041242DBB08A05C03485B1D90F7FD2D93C8B6529E9E03B7697C324A1C66BA953CCCB
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
223
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1f50bdf74a64aac8ae53532f8c66fa2a521442913ed0cb7b0306aa64dae33027
Verdict:
No threats detected
Analysis date:
2023-05-05 11:25:43 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0cbe18ff-6716-43ed-8d83-86630ccd1b87

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/386821/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6454e81003145f701ea2b1f7/reports/654a0176-d193-4350-baec-db6ec849ec48/overview
Verdict:
Malicious
Labled as:
Ser.Razy.Generic
Link:
https://www.hybrid-analysis.com/sample/1f50bdf74a64aac8ae53532f8c66fa2a521442913ed0cb7b0306aa64dae33027
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/289201f8-f502-43fc-be58-d45f4f375408
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1226847
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f50bdf74a64aac8ae53532f8c66fa2a521442913ed0cb7b0306aa64dae33027/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-05-05 11:27:09 UTC
File Type:
PE (Exe)
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d5il352kmsvmrlstkmxyyzx2fjjbiqurh3imw6yda2vgjwxdgatq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
02ea9a838872751f53f53611015ee23062c2cbc9b71a962caf500e54a145e87e
Formbook
3fc3939a2fc6d4c3fca7f8a09523c19052dde1cc175d80d03cd9f54e3543111b
Formbook
6f4246a44c4b69ed8cc30d0583be906c7a8040216321889da1bd74ba7815aedd
Formbook
77d1fdfe97133791cbc164ccee4b98387f1f65205c22cb6c1a63df7f212fc151
Formbook
7a41ce40c35cb716b149ae68e2fff7e91f8dbb3af2f265c70ba08ce4615853d9
Formbook
833a839bf412c22e06f2a3c0622e460df8fc5edbf55cdad09e7b76d5d73dacaa
Formbook
9f7cf45ec90f610f2082d73af4e88d1d4aa2ad1ba0ed8dbbf2b7c62750ea0913
Formbook
c8a94c78a7376f91457a32319670c828f10d5616712154c969ef65bee7de122f
Formbook
d1edcffd58ccef4c9709f027948bb28d09b1aee267cdd9b1271f7136b37ebd94
Formbook
ddaf9934762825fb0168b9c861d81cbc664ee2248c912e0ed8bd980289577ee5
Formbook
+ 2'730 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230505-nkgzrsbg3x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
e61ac527e9df7de516d037728aec9bd45ea23fb50b664d01a282fd189b1332c3
MD5 hash:
c54c6b0ca06f8ae48ea96343f130e7d8
SHA1 hash:
cd38522c5d90d1fc4a3e089d3510ea7eea3704ca
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/829c60ab-2c4a-4a28-99a6-6e9955e271ef/
SH256 hash:
1f50bdf74a64aac8ae53532f8c66fa2a521442913ed0cb7b0306aa64dae33027
MD5 hash:
499dff4ed765de8f503bbce011370996
SHA1 hash:
7b1d695c83acc38ece1844bb337f627a183e5de1
Link:
https://www.unpac.me/results/829c60ab-2c4a-4a28-99a6-6e9955e271ef/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1f50bdf74a64/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1f50bdf74a64aac8ae53532f8c66fa2a521442913ed0cb7b0306aa64dae33027

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/386821/

Comments