MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28ca1fe12d85075d947b1bc3292c14cba784ed1e22287e56819d9a1d86b2f7e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28ca1fe12d85075d947b1bc3292c14cba784ed1e22287e56819d9a1d86b2f7e4
SHA3-384 hash: e9ebd9ab2b840a18ae6eb4c918078eb3f4f2eef77e1f1d293b23207093b352afdd80681d736f2d63f4bf7207ac7ebb40
SHA1 hash: 1c46c2f11abbbfa1366b4b11399db8ba314c5e64
MD5 hash: 659cbf70042b70294be8c952b8cf744c
humanhash: video-victor-west-romeo
File name:decode_f5a3ef195a34fd8d4549a25d275c5084e8cfe9e2a09e257145e14b8a6e33f9c3
Download: download sample
Signature Formbook
Create hunting rule
File size:189'952 bytes
First seen:2023-01-23 15:41:44 UTC
Last seen:2023-01-24 10:29:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:antA0o3EbcekeolLrMH4QeXsxYz6eSJo3mpu4S8uhHMImlDBOT:aivEgjVrbQ7xYz6/Jo393HM9u
Threatray 20'067 similar samples on MalwareBazaar
TLSH T16404139ED49870D6FEB6A77A1B4B6A9452023BF0800ED5A3A37CD1C6B049BE5770530F
Reporter jstrosch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
219
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
decode_f5a3ef195a34fd8d4549a25d275c5084e8cfe9e2a09e257145e14b8a6e33f9c3
Verdict:
No threats detected
Analysis date:
2023-01-23 15:51:31 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a882817e-dd48-4388-b64a-f71460d50c87

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/355953/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Verdict:
No Threat
Threat level:
  2/10
Confidence:
67%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/63ceaadf447edb203a00690c/reports/f59532e6-3b04-450a-a301-493b7aafb3d9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6ed354c9-d7f6-4bc2-bc4f-525a642a80c5
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1157134
Signature
Antivirus / Scanner detection for submitted sample
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28ca1fe12d85075d947b1bc3292c14cba784ed1e22287e56819d9a1d86b2f7e4/
Threat name:
Win32.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2023-01-23 15:44:51 UTC
File Type:
PE (Exe)
AV detection:
21 of 39 (53.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fdfb7yjnqudv3fd3dpbsslauzotyj3i6eiuh4vubtwnb3bvs67sa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0dd1d1a74f49a15f9b7dcfc7890060807198b74b835cb17f60886a0f2c9c1376
Formbook
1c120ac2bc08fbd5455f3d5a47dd87ce73e40fa4b0f7a3cdb2d41a85c800e603
Formbook
1e9c6feb801d3596d0090cb133a916998b321902a9088cd6b72fe0c9013a5ee9
Formbook
27092cac933ddf8f3790ad2cfdd8bb8ffa80adec09f96f4acb2b3ee24ee2157e
Formbook
476cfcd8e4efbaad00e44089bfe1eab950cd627656f960b74a1dce1f9e5686dc
Formbook
492cabb55a2f649ce32194e8f9737a51f071b370bc9cd527aa8cd0b844ee7ea8
Formbook
aabd50ed2fa819acc63c5209c80e7f18571057e452fae36f2b8fea580622ec9b
Formbook
b6fe7602e8f288c48cf04e60306dc9349c5b9ebeb8faf35905abede7d0525480
Formbook
e12e92ded58d05cf87a0cdf4323859145f5aa09da69e4dd3ab622e65a9888587
Formbook
ff25677389d599682cc411460963f6adbff3879c2f2d3d7239312acfd57f42fe
Formbook
+ 20'057 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230123-s5cm1aea39/
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
89ad70b085f6be4c38e9866bdd9a00c0816c96e90a299113ddfc0974c507f013
MD5 hash:
65c2e23b48d0211815483216a18ed2f4
SHA1 hash:
6f9eca2f61fe45f55e508f67648cf88017d1de18
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/98933a2e-160d-468f-b60d-651cca5c8370/
SH256 hash:
28ca1fe12d85075d947b1bc3292c14cba784ed1e22287e56819d9a1d86b2f7e4
MD5 hash:
659cbf70042b70294be8c952b8cf744c
SHA1 hash:
1c46c2f11abbbfa1366b4b11399db8ba314c5e64
Link:
https://www.unpac.me/results/98933a2e-160d-468f-b60d-651cca5c8370/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/28ca1fe12d85/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/28ca1fe12d85075d947b1bc3292c14cba784ed1e22287e56819d9a1d86b2f7e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/355953/

Comments