MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22e9913895987cd95d1bc1a32a2175f9a734399ce4c62e70a31c11ae4d2f051a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 15

Intelligence 15 IOCs YARA 1 File information Comments 1

SHA256 hash:	22e9913895987cd95d1bc1a32a2175f9a734399ce4c62e70a31c11ae4d2f051a
SHA3-384 hash:	f9930d3d946f696e70dc733a201cbd328b07533026ba0c0192dd764a81f6cf8bccc5a3a836c23757c300767e022d032b
SHA1 hash:	52fcfbd031e83d80cc70a22e1a1d68c4b4d042d3
MD5 hash:	aa0bf88f08fb6d4ab0286244020d6518
humanhash:	skylark-oklahoma-florida-louisiana
File name:	aa0bf88f08fb6d4ab0286244020d6518
Download:	download sample
Signature	Formbook Create hunting rule
File size:	291'922 bytes
First seen:	2023-06-19 11:24:00 UTC
Last seen:	2023-06-19 11:44:08 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep	6144:/Ya6qvFo/wOQGfQUzsaYZWHrStBsR59+JvPXT:/YMvy3xfDaSjR59+JvL
Threatray	1'190 similar samples on MalwareBazaar
TLSH	T1BF5412247190C4FBF8A35AB01A3D46956AF4CD1324244B4B4794AFEE3BBE7D2E90D781
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	zbetcheckin
Tags:	32 exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

277

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

aa0bf88f08fb6d4ab0286244020d6518

Verdict:

Suspicious activity

Analysis date:

2023-06-19 11:26:04 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/002a24da-95c7-4080-8809-0cbb18010f23

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/400389/

Detection(s):

SecuriteInfo.com.Gen.Variant.Nemesis.22774.4142.22000.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Creating a file in the %temp% directory

Creating a window

Creating a file

Unauthorized injection to a recently created process

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/91555/overview

Behaviour

MalwareBazaar

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lolbin overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/64903ad710461c2d676a6915/reports/a35d2138-7673-4d29-9cac-0077eeb8e515/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/22e9913895987cd95d1bc1a32a2175f9a734399ce4c62e70a31c11ae4d2f051a

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/345a30c9-d940-4568-97ec-a32cc5d0d937

Result

Threat name:

NSISDropper, FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1257726

Signature

Detected unpacking (changes PE section rights)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected FormBook

Yara detected NSISDropper

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/22e9913895987cd95d1bc1a32a2175f9a734399ce4c62e70a31c11ae4d2f051a/

Threat name:

Win32.Trojan.GuLoader

Status:

Malicious

First seen:

2023-06-19 11:24:09 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eluzcoevtb6nsxi3ygrsuilv7gttiom44tdc44fddqi24tjpauna._file

Verdict:

malicious

Label(s):

formbook

Formbook

213002db79b1a5e11521190f9f11fcdda96e24ab0f382fff8b9f6347c618631d

Formbook

3a5125b535a9d3aec7608c040173cea1e3c12cb855ec5bad90847406022dfe98

Formbook

7517367b3b61170bb7637de6f89077069159c4a04f430c28102e2d7cf5a0343a

Formbook

99ec8b8e93e7a91dab1a16b9353333fa340d52569de4b88f5703bbc5a666211c

Formbook

ce902a74a974d8abadef885c3aa91a41ad495d0d22a187b0bb4c87645d3ae0a8

Formbook

d004812639335fc21774851e271241aaead5918a69f978e1aedb6b573b6cca1b

Formbook

e904274bd2e5d919c63c6db8c82f908abc10d65fdba772596e2953ab708b1726

Formbook

f87ffcf023d6faf89bdd6b5f035b2a65f2a46d81a5a88b337691c5678fa6e7dd

Formbook

+ 1'180 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/230619-nhpxlade49/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Loads dropped DLL

Unpacked files

SH256 hash:

c4c7db2f55f34e3c727c55a0d5076648d6fdce8b1bd04b3c624c34c2b6c36341

MD5 hash:

c3d441cb1010935281037ce5cb258bfd

SHA1 hash:

ff90b938d2eac4a54963c420f6f6c3727c3724ce

Link:

https://www.unpac.me/results/f4679eb9-c6c9-4883-8a04-187592136e9d/

SH256 hash:

22e9913895987cd95d1bc1a32a2175f9a734399ce4c62e70a31c11ae4d2f051a

MD5 hash:

aa0bf88f08fb6d4ab0286244020d6518

SHA1 hash:

52fcfbd031e83d80cc70a22e1a1d68c4b4d042d3

Link:

https://www.unpac.me/results/f4679eb9-c6c9-4883-8a04-187592136e9d/

Malware family:

XLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/22e991389598/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/22e9913895987cd95d1bc1a32a2175f9a734399ce4c62e70a31c11ae4d2f051a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.