MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fcaaed1008bcb79bbfac57a3927a03a8364ab00fce3080b2ea581116a6e8ba6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 16

Intelligence 16 IOCs YARA 1 File information Comments 1

SHA256 hash:	1fcaaed1008bcb79bbfac57a3927a03a8364ab00fce3080b2ea581116a6e8ba6
SHA3-384 hash:	ebd7768723e312fdfbbb5c802f75432290a1f4014b383b9335622bc3068020104dfb67aa2ee222951d2510cb9e59d521
SHA1 hash:	37be005b43001e4a3cd0bf922c3c5092b711ecaf
MD5 hash:	fa24b7c4c3dc0c6d0b942eb96e4f18a0
humanhash:	moon-lion-friend-delta
File name:	fa24b7c4c3dc0c6d0b942eb96e4f18a0
Download:	download sample
Signature	Formbook Create hunting rule
File size:	272'284 bytes
First seen:	2023-06-20 04:47:00 UTC
Last seen:	2023-06-20 07:38:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep	6144:/Ya6Id9xfmNNjisQm9E/WtwQ4OBXLY/GOwq6q1IDgFhfaoew3:/Y+3xfmN2sQUKQDXL0q8ICB3
Threatray	1'140 similar samples on MalwareBazaar
TLSH	T19B44124C6AB1CACBDC722733777C17FAAE65953164FC164F47705B28B920BA1E81A342
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	zbetcheckin
Tags:	32 exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

279

Origin country :

Vendor Threat Intelligence

Malware family:

formbook

ID:

File name:

backup-message-10.48.112.68_9045-1021434.eml

Verdict:

Malicious activity

Analysis date:

2023-06-17 10:40:22 UTC

Tags:

opendir exploit cve-2017-11882 loader formbook trojan stealer

Link:

https://app.any.run/tasks/a8a066d0-f8f3-4282-a3c0-40f9b1761709

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/400714/

Detection(s):

SecuriteInfo.com.Gen.Variant.Nemesis.22774.31105.19173.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Creating a file

Unauthorized injection to a recently created process

Sending a custom TCP request

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/91693/overview

Behaviour

MalwareBazaar

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lolbin overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/64912f463067ea15b6567936/reports/a5a45bb0-5eaa-4f70-9576-39ac4c80b7ca/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/1fcaaed1008bcb79bbfac57a3927a03a8364ab00fce3080b2ea581116a6e8ba6

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/333fa96e-1aef-4785-93eb-be089ce44b15

Result

Threat name:

NSISDropper, FormBook

Detection:

malicious

Classification:

troj.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1257877

Signature

Detected unpacking (changes PE section rights)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected FormBook

Yara detected NSISDropper

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1fcaaed1008bcb79bbfac57a3927a03a8364ab00fce3080b2ea581116a6e8ba6/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2023-06-16 21:37:26 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d7fk5uiarpfxto72yv5dsj5ahkbwjkya7trqqczouwarc2torota._file

Verdict:

malicious

Label(s):

formbook

Formbook

22e9913895987cd95d1bc1a32a2175f9a734399ce4c62e70a31c11ae4d2f051a

Formbook

3053bf83f68a367d52f30660d789d79bc26b7829af496864e777ad8a38450366

Formbook

35511df3a80e96c275e6d63f58921358bf51dbef3f981a316d2212242112ba9f

Formbook

47f864675366fb037a82ab00b3a888feece7a673376e7eb1fcb38cfd3213ccaa

Formbook

490ab8c4bcefb5cd52f0ba2697e3d7f470c9280cac52ed1e96167a2c8d899ec2

Formbook

5c2656c838e9a793b1385f97da2b8ce2671c26bfb2863f3fdb4cef89ed94fc4c

Formbook

bbb16ff7e472adf4acdcf9576a2977b930f36622848b2f0c3e954f6916a273c9

Formbook

c5f31d9d3c1a204926f1a87c5873b01ba37153af5e55594ac5037091d56026ac

Formbook

cb51a857dc33e532754e21259545e94dd518baff0783b8dd0623a20621af3a28

Formbook

+ 1'130 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/230620-feh1wahh48/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Loads dropped DLL

Unpacked files

SH256 hash:

6760ccf00dfff216aa5ff6815aaa1cecdfaa16d65f378af8166ce638ea655081

MD5 hash:

0177e50467e101a4516842e99de1b197

SHA1 hash:

96972bdf37d92630bcdae67390657d0173e6103b

Link:

https://www.unpac.me/results/194c17af-d0dd-43f0-a210-bbbe1f9012fd/

SH256 hash:

1fcaaed1008bcb79bbfac57a3927a03a8364ab00fce3080b2ea581116a6e8ba6

MD5 hash:

fa24b7c4c3dc0c6d0b942eb96e4f18a0

SHA1 hash:

37be005b43001e4a3cd0bf922c3c5092b711ecaf

Link:

https://www.unpac.me/results/194c17af-d0dd-43f0-a210-bbbe1f9012fd/

Malware family:

XLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1fcaaed1008b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1fcaaed1008bcb79bbfac57a3927a03a8364ab00fce3080b2ea581116a6e8ba6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.