MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1fd55a441baa9459201847aa7aedb8262e45fac43f8f2f7fc09be53300c0f18b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | 1fd55a441baa9459201847aa7aedb8262e45fac43f8f2f7fc09be53300c0f18b |
|---|---|
| SHA3-384 hash: | a09a41b2b2ce541bcbcd1d5bedeca191c99a53cd1ec6a2aaed05a33082dac45ac90c7682ceb5974c6a5894a7656d81b4 |
| SHA1 hash: | ae0bd1f64f7e972eae344bcfa1360081988e2842 |
| MD5 hash: | 930f9443825ac6382109d445a91fba74 |
| humanhash: | oscar-tennis-quebec-earth |
| File name: | SecuriteInfo.com.Win32.PWSX-gen.9744.4676 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 943'616 bytes |
| First seen: | 2022-12-12 10:30:58 UTC |
| Last seen: | 2022-12-12 13:05:07 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'649 x Formbook, 12'245 x SnakeKeylogger) |
| ssdeep | 12288:l/iNXXD5lNRB65BcUQIVR6wseLkgPQei7zxux/u6tiKxXGG:R2lfKNfVR6wsIRPQZ7zUx/u6JgG |
| TLSH | T1FA157C2CEBD8E6B9EFD7BAD6062A6FD00956E5C81E93F1958C3F71AD0D10210F006D96 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.9744.4676
Verdict:
Suspicious activity
Analysis date:
2022-12-12 10:49:29 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Launching a process
Creating a window
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Signature
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-12-12 10:31:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
20 of 26 (76.92%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook campaign:asdo rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
b5dc38c35d622e435dee068d64b68bc6893099b661cdcba799109a18d0ba8ceb
MD5 hash:
5f8a79f19072c6b5c7a2df3c8e963e1a
SHA1 hash:
2394cd16ae20e729925a1efbe68101817d3d58f5
Detections:
XLoader
win_formbook_auto
win_formbook_g0
Parent samples :
a02026fbb721304677f2b4d6f58d9171d5e411727f6b6c06a8a2ef1792f4c2a8
082215d9272c7f706e6cc3b5f75abaa5e264566c1f6dec9fd0cd770d4bd86b4b
1fd55a441baa9459201847aa7aedb8262e45fac43f8f2f7fc09be53300c0f18b
26166c41b0a5364406a3c3f9c42d3f2bc3786aa5f32c71ee0675773bd7cc2125
a831aa365ba3881d1b31e77d45bb547a8b39fc19e16b3303399dae2ccb52a31f
082215d9272c7f706e6cc3b5f75abaa5e264566c1f6dec9fd0cd770d4bd86b4b
1fd55a441baa9459201847aa7aedb8262e45fac43f8f2f7fc09be53300c0f18b
26166c41b0a5364406a3c3f9c42d3f2bc3786aa5f32c71ee0675773bd7cc2125
a831aa365ba3881d1b31e77d45bb547a8b39fc19e16b3303399dae2ccb52a31f
SH256 hash:
305c2a1cd734e1ec7a9e86bc6294083b3b504f5ca11366dde63649695bd66c51
MD5 hash:
cd6c03f5dde8dcea5f361aeff1eeb2d8
SHA1 hash:
c55f8f77efc681ce5db7fe1723d3c0fed985638f
SH256 hash:
a01bef6543650ff4a14669731e7c7a5f1ccb8c381e5f3f5d0bce739e2b411202
MD5 hash:
5b39ad033bf2fa2e8a9d82b61f22a8c2
SHA1 hash:
e2c17091893605d783fac0a0a0a7870534320d4c
SH256 hash:
58ea24e5ab90a6bec98efa71b0b5a356fb05684466025d4829916f0b9cc15b60
MD5 hash:
133aafd0f74bf8934b917003f769841d
SHA1 hash:
b62b29ea75bde2c1c904248bf242c79afd142cd4
SH256 hash:
922915132a628d0050bf03a473370544dde3323627fb4adcba3f1ba869537e50
MD5 hash:
1ecb63625d636b0b8f8ebdece9fa80c3
SHA1 hash:
5623d5ad21fc63893011bae7e4709c51219fcc1c
SH256 hash:
340ba2312d5cdfc3d89f3f35f627187dcb406e5afea134bc76b04f52f4285df3
MD5 hash:
85f9290aa8900e9fd74b01ee23125706
SHA1 hash:
310eb5e4aea5471b74a6385f1da283b9d8e3d698
SH256 hash:
1fd55a441baa9459201847aa7aedb8262e45fac43f8f2f7fc09be53300c0f18b
MD5 hash:
930f9443825ac6382109d445a91fba74
SHA1 hash:
ae0bd1f64f7e972eae344bcfa1360081988e2842
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.