MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29fc28e7fe1f87451e12b9a12800c80c56a3e88d0934ba5090d7e585b32fac30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	29fc28e7fe1f87451e12b9a12800c80c56a3e88d0934ba5090d7e585b32fac30
SHA3-384 hash:	c4a4ea12e2e392ebd50fecee6a6e1b0283e3f7ce701402ae98cdb35820d9d7dc51f05110a0bc211d2c6e2fb8dc3c5f92
SHA1 hash:	1670c3b05c6324da0a41dc390b302bae82458c47
MD5 hash:	c064d51ec078dea29120a759e6ae010d
humanhash:	echo-wisconsin-five-coffee
File name:	SCAN-ZAHLUNG22.05.23.exe
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	328'704 bytes
First seen:	2023-05-22 16:35:51 UTC
Last seen:	2023-05-22 17:40:18 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	dcc3403437adbaa710d120d49b019308 (1 x Formbook, 1 x RedLineStealer)
ssdeep	6144:XzcBM+Mi0nEWxxy04Mdy/oarwbBARmyfbLB66w4cDUdCF:Xz6ii0EWxxy04MdsT8AUMLc6JcICF
Threatray	2'891 similar samples on MalwareBazaar
TLSH	T14D64F12176D9C032F22225344A72C6A18B37B8729BB19DCF2F91567A0F653C3DAB4716
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	98a6c5c6d3cbcfc7 (1 x Formbook)
Reporter	lowmal3
Tags:	exe FormBook

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

272

Origin country :

DE

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

SCAN-ZAHLUNG22.05.23.exe

Verdict:

No threats detected

Analysis date:

2023-05-22 16:37:48 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/29811d54-6bad-4d64-841f-05e9324c7030

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

Sanesecurity.Malware.29323.BadIN.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Сreating synchronization primitives

Sending a custom TCP request

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/87449/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

CheckCmdLine

EvasionGetTickCount

EvasionQueryPerformanceCounter

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

greyware overlay packed

Link:

https://www.filescan.io/uploads/646b99f3642a967932809bfa/reports/1f663686-d577-47aa-b3d2-6c6816d3e2f1/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/29fc28e7fe1f87451e12b9a12800c80c56a3e88d0934ba5090d7e585b32fac30

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Formbook

Malware family:

Formbook

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0385dc85-cc73-44b3-962e-260a30366392

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

evad.troj

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1239840

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/29fc28e7fe1f87451e12b9a12800c80c56a3e88d0934ba5090d7e585b32fac30/

ReversingLabs TitaniumCloud Win32.Trojan.Smokeloader

Threat name:

Win32.Trojan.Smokeloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-22 16:36:08 UTC

File Type:

PE (Exe)

Extracted files:

8

AV detection:

16 of 24 (66.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fh6crz76d6dukhqsxgqsqagibrlkh2enbe2luueq27sylmzpvqya._file

Threatray formbook

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

Similar samples:

268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63

Formbook

4f285ae8e4b4fc0bc50cb639a413412a276f7d187770da6fb5e089eeeff9145e

Formbook

57201e9c5bef2bad5111f1989ec265dead9dd75adac4030201cdb1c7ec4deeff

Formbook

596b439c3130f5a6668f71725e2cb80791bcda5cad2cbd8ba828e7ef676118f4

Formbook

5a46bd65bf5067b29396df720a7f67abb3a773ee9ffa19587242bfeb6f5c4d15

Formbook

5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37

Formbook

688ba75525fea2de02b06a99c4698724cb865d8e0f195d1b7b436aba7d942541

Formbook

97a6db96fa0467a8cbe068fe3b09b0c03c2be85e2902503464e3af90e4e80af1

Formbook

dc18df47b5b99206344abe7dc551b531f134a14e7f8c3390fb419167ce435f01

Formbook

ee358a011cc5cb7f997685a47255bd3ebe7d1632c5e09099f5f70767c5061290

Formbook

+ 2'881 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230522-t38s4abd64/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Checks computer location settings

UnpacMe win_formbook_w0 win_formbook_auto win_formbook_g0

Unpacked files

SH256 hash:

34b16d9aa34a06209411186e956239c1877e490dd9b6306aca2b8537066b63d9

MD5 hash:

26afa958b72d27bea25fdefb55e8731f

SHA1 hash:

acd603736e0b670ca198059d61c8cd3884aa5c56

Detections:

win_formbook_w0

Alert

Create hunting rule

win_formbook_auto

Alert

Create hunting rule

win_formbook_g0

Alert

Create hunting rule

Link:

https://www.unpac.me/results/55939133-c32b-49d0-a8e3-be61a06707cb/

Parent samples :

ee358a011cc5cb7f997685a47255bd3ebe7d1632c5e09099f5f70767c5061290
688ba75525fea2de02b06a99c4698724cb865d8e0f195d1b7b436aba7d942541
29fc28e7fe1f87451e12b9a12800c80c56a3e88d0934ba5090d7e585b32fac30
f6b74362f5c3be4483dfeea056310801a4694ae9f8ed0f42c2ac99c86c752880
44bea404825374b13944297270be55bb2e18c7b95b2c7051800e4fb2d5fc2dbc
a15e826b6d0b658c57976684b1d2d20459ac7e5013f5cdeb12bfa2c8ff7359c8
4a4e3d020a90d81969f2458b4de891ac4cf1bc2b4e0c15eb42e0a0a26a3b66f3
52cde2b88aa65fd327813294d67dc3cc10ffaa1774acc0c7a5d40de397de2871

SH256 hash:

0abcaa4dd531ab1cd2b6eb8dc6b017da8c25f8168f647cfc2d5bdf6f792e1559

MD5 hash:

d62e812dd0ed624a487f87ee35c37089

SHA1 hash:

acf85b6fd0d54f81a5cb647d734cf3fe01aebc3d

Link:

https://www.unpac.me/results/55939133-c32b-49d0-a8e3-be61a06707cb/

SH256 hash:

29fc28e7fe1f87451e12b9a12800c80c56a3e88d0934ba5090d7e585b32fac30

MD5 hash:

c064d51ec078dea29120a759e6ae010d

SHA1 hash:

1670c3b05c6324da0a41dc390b302bae82458c47

Link:

https://www.unpac.me/results/55939133-c32b-49d0-a8e3-be61a06707cb/

VMRay XLoader

Malware family:

XLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/29fc28e7fe1f/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/29fc28e7fe1f87451e12b9a12800c80c56a3e88d0934ba5090d7e585b32fac30