MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2a8e12ba39638644d25a0c310f498e9c5226d9aad980b8617f3c265c1fab3b38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 12
| SHA256 hash: | 2a8e12ba39638644d25a0c310f498e9c5226d9aad980b8617f3c265c1fab3b38 |
|---|---|
| SHA3-384 hash: | f75309fb108a60d17175e1d2df6d10641b6a1ed6ec9e7853a6a0be898487d80a5341c4fb225d644fb69727fde33e507d |
| SHA1 hash: | c2a65e4056d571a92d96cfb84ed0b45cc05e9677 |
| MD5 hash: | 55442103dc8197f7588da2f0c01eeff3 |
| humanhash: | mountain-triple-may-missouri |
| File name: | Swift Copy_002.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 666'624 bytes |
| First seen: | 2023-11-28 16:41:58 UTC |
| Last seen: | 2023-11-28 18:15:36 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 12288:ENCQmbCp7KL7e1TR9ZboEg7SQDAQ23pmym7jEl9ttcP1AWCngohZiwp:Y0CvzIgpIjEl9tnWCngJ |
| TLSH | T18BE423753B2CE1B7C7BA97F8E454A9128378B6422871F3D95EC254DD8DE1B804302B67 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | 68c4d2d2725a5252 (10 x Formbook, 8 x AgentTesla, 3 x SnakeKeylogger) |
| Reporter |  lowmal3 |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
306
Origin country :
DEVendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus detection for URL or domain
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-11-28 03:48:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
15 of 37 (40.54%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
ebdf6a2c9737254d857e3ad247f36742093bbacb14763332a47d859a1e5c8ca6
MD5 hash:
c42df6662aee5552c18c1d6710d708d6
SHA1 hash:
a64547862b2a62b35b043fc14494140261b5042c
Detections:
win_formbook_w0
win_formbook_g0
SH256 hash:
2033bb6e7915891ed7ee81bfd5b50a572962e3f4e383758d3dd1c4411758029e
MD5 hash:
a09c3b7b1ada07559aa727bc450da201
SHA1 hash:
e5a7811c903dd29a06713ca23586447d2fc34692
SH256 hash:
dc2a31ebcef7e1b02ef0b2237da0e126dfebaa6a6336f829c0194b89793e239b
MD5 hash:
3d9dd0ed4f6deb6ad320d84fa5a40542
SHA1 hash:
f2daf79f4bfd1118856e13e1487c99259415d39e
SH256 hash:
2a0290a662e89a81ed2d9c73e54a0aeba209fc36617f134cf0aaa74690db47db
MD5 hash:
4820945deb84d6bd26460e8a6ba0c622
SHA1 hash:
c519540ad21594fa45fcc2e6e15cfbea8b3449b9
SH256 hash:
bd3f2562a07ebf0a6bb0dda2cd20281ab3b36fecac4ae086d2985937c0b7030c
MD5 hash:
f2cc4f3c1bbbaad721272dd259742620
SHA1 hash:
99b63a407e71c56597c8be3ff89b89fa6724d0e8
SH256 hash:
e412b9b44b45e0d6eea46065024f8937997e6ef88db6a43880e46edbd36e7418
MD5 hash:
bf5fcc64ae744badf9a37270940e5101
SHA1 hash:
c65d51b440bdfccc406b5d96f237e7e476b401d4
SH256 hash:
4ee3b148e28f3d34dddb1e42bedf32d735816f93a305be7ed9a89f10bfd7b9b9
MD5 hash:
6306c929489c69591dccd83232757930
SHA1 hash:
909ff3f2b54db34b14a27c86b0aa016ee92ae6af
SH256 hash:
ad047ab37a8969a4d081afe262572a2338f24b286be678f8e6e6764ef52d87d3
MD5 hash:
a917c18cf9ded5ff89e8f08aa294916c
SHA1 hash:
89ab0ee19eca61f89563b7d3e8c58cab4403de7a
SH256 hash:
e9ca3b6afcdb55ab6ce006a57249af763b874e33c35dab8e0500171b9e6d2e00
MD5 hash:
b121678710f709602db7f50fc4053495
SHA1 hash:
44033a6f710859acdb8206b0cb37d01d1119cbb5
SH256 hash:
25f191015b14942d7e5845ee37135b02e4161884277cd1e76c322e0aa87bc230
MD5 hash:
9930bae9ac4ebc504f971c95b3abf07e
SHA1 hash:
3fb9487ec08eedad8adbb9c4264cac34376bc7a4
SH256 hash:
0a80271f12cb418169b5f5e0d69ae8374fc5b79d8678b80a947a986742d6e79d
MD5 hash:
932b52d17a7abd66ea6109c3911833e6
SHA1 hash:
0f126096028fdd3ba73bbc39e1931f480fa378dc
SH256 hash:
2a8e12ba39638644d25a0c310f498e9c5226d9aad980b8617f3c265c1fab3b38
MD5 hash:
55442103dc8197f7588da2f0c01eeff3
SHA1 hash:
c2a65e4056d571a92d96cfb84ed0b45cc05e9677
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Formbook |
|---|---|
| Author: | kevoreilly |
| Description: | Formbook Payload |
| Rule name: | maldoc_getEIP_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Windows_Trojan_Formbook |
|---|---|
| Author: | @malgamy12 |
| Rule name: | Windows_Trojan_Formbook_1112e116 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_formbook_w0 |
|---|---|
| Author: | @malgamy12 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.