MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c6b67cc0adc1f6ca39dbffcce72276296faae3feffecee9051846ab5fc34b05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c6b67cc0adc1f6ca39dbffcce72276296faae3feffecee9051846ab5fc34b05
SHA3-384 hash: 1983dae824f2c712853ef4c2e7e351f7665c33871874096f11e395ae3281bbfc0f2bfc5b3cce18c548991181405324d8
SHA1 hash: 5da9fd15cd28b117bed283a079ad34b482214bbc
MD5 hash: dab5e5810afc1db3c160c7415ddb836a
humanhash: floor-mars-snake-carpet
File name:Account Statement For Month End July.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:319'987 bytes
First seen:2023-08-16 13:30:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep 6144:/Ya61gHodAM9zrkVl33OvX7vYCjjYMoWXzoOTqkRFUALEK0OsWte:/YfgHwC+vTZjYMDj1lYAYrOq
Threatray 3'726 similar samples on MalwareBazaar
TLSH T1E3642300B3F0C476E8B64A7199323EE38FE5722A3A11954F27E04F9C7B114D95D6DBA8
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter cocaman
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
262
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Account Statement For Month End July.exe
Verdict:
Suspicious activity
Analysis date:
2023-08-16 13:32:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b3f063df-0cb6-42d5-9d78-c7aa92f339a2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/443050/
Detection(s):
Sanesecurity.Rogue.0hr.20230814-1137.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file
Unauthorized injection to a recently created process
Restart of the analyzed sample
Сreating synchronization primitives
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/102984/overview
Behaviour
MalwareBazaar
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/2c6b67cc0adc1f6ca39dbffcce72276296faae3feffecee9051846ab5fc34b05
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/31f17052-5c16-4825-8b72-0d556df35988
Result
Threat name:
FormBook, NSISDropper
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1292160
Signature
Detected unpacking (changes PE section rights)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected FormBook
Yara detected NSISDropper
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c6b67cc0adc1f6ca39dbffcce72276296faae3feffecee9051846ab5fc34b05/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-08-14 08:57:42 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=frvwptak3qpwzi45x76m44rhmklpvlr7577m52ifdbdkwx6djmcq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
032948bc1f91de998ac96af702ec58223c3b15d653b9fa7778163dd5b120b5d6
Formbook
216237da181e0a4fe72486534f4fb7694641a34508dce78b3d36acbd53bd9dba
Formbook
57201e9c5bef2bad5111f1989ec265dead9dd75adac4030201cdb1c7ec4deeff
Formbook
5a46bd65bf5067b29396df720a7f67abb3a773ee9ffa19587242bfeb6f5c4d15
Formbook
5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37
Formbook
86fe793dd78fe5b8f80d271bad4f574577222d150fa1d21517f26ac8b77193be
Formbook
93512f8df3b84088ddebeaa216201bfc2a2e9d68ded4133a9ef94fc5f154b229
Formbook
da9ce816092043ded7f22e3368f1beaa75577190bdab4da16936d7c1bf774e84
Formbook
e325cd7917bb15d2b08a1028083d1bcdbfe46cc42e272f603382cfc30ff2dd10
Formbook
f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad
Formbook
+ 3'716 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230816-qsdcnach8z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Unpacked files
SH256 hash:
c2b15e074a90db6016d66d32343ffaab5191894ddf9401a3e40a55f0f959e3d4
MD5 hash:
31d8bc53323b55c07e4b48af3bb436c3
SHA1 hash:
6e43dfae02e870089ecf30c1dd6cef9975cb07ec
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/fe59636d-8e3a-4910-b8c5-f8619924e79e/
Parent samples :
93512f8df3b84088ddebeaa216201bfc2a2e9d68ded4133a9ef94fc5f154b229
86fe793dd78fe5b8f80d271bad4f574577222d150fa1d21517f26ac8b77193be
1b7d0e37b2c2465020c57cb6ca8b3d15546b862cef6a06fb2d4c6aa5d94263b0
032948bc1f91de998ac96af702ec58223c3b15d653b9fa7778163dd5b120b5d6
2c6b67cc0adc1f6ca39dbffcce72276296faae3feffecee9051846ab5fc34b05
SH256 hash:
13a3f7469cd3fccc28a2f13f9f14075fbb34f6830b5ae18ac9680e4683122822
MD5 hash:
f2204d5335886f292dc02c0a754874ab
SHA1 hash:
a16afd9c7f1ff8ad19c33b6b313134ffaed8f0ed
Link:
https://www.unpac.me/results/fe59636d-8e3a-4910-b8c5-f8619924e79e/
SH256 hash:
be3a2c6661e7a30234cfff2387edba23026b615d123668d7b6177025d5412200
MD5 hash:
bcdb48df58bf0ce598cf19b1327df3a9
SHA1 hash:
105c5dfe780166b648d8c577d048125c1df660d7
Link:
https://www.unpac.me/results/fe59636d-8e3a-4910-b8c5-f8619924e79e/
SH256 hash:
2c6b67cc0adc1f6ca39dbffcce72276296faae3feffecee9051846ab5fc34b05
MD5 hash:
dab5e5810afc1db3c160c7415ddb836a
SHA1 hash:
5da9fd15cd28b117bed283a079ad34b482214bbc
Link:
https://www.unpac.me/results/fe59636d-8e3a-4910-b8c5-f8619924e79e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2c6b67cc0adc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2c6b67cc0adc1f6ca39dbffcce72276296faae3feffecee9051846ab5fc34b05

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar cbd35093a173bb62ce12acbc35a065d4b2e4dd2ac9bf07c4876a4569e76e2bde

Formbook

Executable exe 2c6b67cc0adc1f6ca39dbffcce72276296faae3feffecee9051846ab5fc34b05

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 cbd35093a173bb62ce12acbc35a065d4b2e4dd2ac9bf07c4876a4569e76e2bde
Cape
Cape
https://www.capesandbox.com/analysis/443050/
  
Dropped by
MD5 a44bc752e7fe301289d01da694e8f151

Comments