MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2818ae5c4fb98d4ac50ce7055d3ff9688dedb6b0e5344a14a341f4c151a36522. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | 2818ae5c4fb98d4ac50ce7055d3ff9688dedb6b0e5344a14a341f4c151a36522 |
|---|---|
| SHA3-384 hash: | 646c33593bbcc2f5e41fe24ffda9263b5310043e2bc7543ce5d583b36fef96c261a9128312c2fe10912de42fc17e2b6a |
| SHA1 hash: | 372c3aab7abb29ac250bcc4aaffbd716d46dcf22 |
| MD5 hash: | 369677713cdb2db6bb77d98db5cec9d8 |
| humanhash: | whiskey-table-utah-illinois |
| File name: | OUTSTANDING SETTLEMENT.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 776'192 bytes |
| First seen: | 2023-06-20 13:42:55 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'603 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 12288:Jb903YzuuPM7q6bpw4dcZda/igJ7bYK5B+64ExpLsFKHxh6hHBjJU:Jb903Yazu4CZdOpMKEmpQUxYhHpJ |
| Threatray | 1'554 similar samples on MalwareBazaar |
| TLSH | T184F412205BD7965BD12A4BB84060E3B4827C4EDA7722D2DF4DCB7DC7BA52BC9063160B |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 2b2555676501612b (15 x AgentTesla, 3 x Loki, 2 x Neshta) |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
287
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
OUTSTANDING SETTLEMENT.exe
Verdict:
Suspicious activity
Analysis date:
2023-06-20 13:45:04 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
89%
Tags:
formbook packed
Verdict:
Malicious
Labled as:
Trojan.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Signature
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Generic
Status:
Suspicious
First seen:
2023-06-20 04:53:27 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
12 of 37 (32.43%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 1'544 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
fd856f89fe5041ffedc98bbddd200164a6eda0d728bde7f7068f97dff9f90ca1
MD5 hash:
dad7dfae2ad65706d4113394008d7bb5
SHA1 hash:
bd0c4a5c6d75846962bfc2e217b899a89ee4fb34
SH256 hash:
a14ed07f2f6493409330c93ced7861833f5f343b5deae8492b4955399fff121b
MD5 hash:
059994602c21f38da4c130b4d04a2d54
SHA1 hash:
97b068431f62efb2b420a3401e110800cc397d84
SH256 hash:
bf30f7032a6e2fdd6a872718de569645dda2c9e734a4f90a77e5af9a58d75812
MD5 hash:
29432c0db5445ce74b8a1042234187af
SHA1 hash:
fdc1bce5c868fbaed48ff27b3cc73b752bc66e75
SH256 hash:
ae28a826aadf2b9f5beab0392baf5f28d2fe78772ee829dd7176eda538b02553
MD5 hash:
b536331634cad2b836cf2d7b5fe05889
SHA1 hash:
b27ed85810ff000a2435b8be653eb089281b8c1d
SH256 hash:
73e9b2af579356f8ad48df339f13ecc9c1956657ce86c09b53bdf7d8b08a35e3
MD5 hash:
39a4421870f454fdd46d8a0386e1b84f
SHA1 hash:
8c34b6f42d4f55d700683068f93b25267d419352
SH256 hash:
2697a2ec0fda6ccc617852a6478e305108c7d6fa99d2cefcbe05cbd0ecd4c09a
MD5 hash:
b02edcacc2db30e0d8bdaa37f973fd00
SHA1 hash:
525e14dea6f77015978fa35ab9fae895ecb7cd36
SH256 hash:
2818ae5c4fb98d4ac50ce7055d3ff9688dedb6b0e5344a14a341f4c151a36522
MD5 hash:
369677713cdb2db6bb77d98db5cec9d8
SHA1 hash:
372c3aab7abb29ac250bcc4aaffbd716d46dcf22
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | pe_imphash |
|---|
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.