MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fcedf25cd8c0df5db7864ff3663f6a923eb3cdf1a30619a2eeb69df58e1c4f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2fcedf25cd8c0df5db7864ff3663f6a923eb3cdf1a30619a2eeb69df58e1c4f1
SHA3-384 hash: 128dcc65817f172f52822690582549a9676cb0cc0ac659926d43c21f4af1389b16a4c11c0c3c84b907fbb4ad529960bd
SHA1 hash: 584467a584fc8dca18a170046f9211dc65411063
MD5 hash: d56127ac43d4c1ae9399a842b7cec470
humanhash: ohio-delta-wyoming-zulu
File name:DHL Shipment Notification,PDF.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:470'958 bytes
First seen:2021-08-02 05:29:51 UTC
Last seen:2021-08-06 09:05:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 32227af8543b6c4653100d3bb07898a3 (3 x SnakeKeylogger, 1 x RedLineStealer, 1 x Formbook)
ssdeep 12288:viN/pHHaiaYtrY1+6+NM6Lc6YXouWUkYZ:vidNVWlZ4uLVZ
Threatray 7'201 similar samples on MalwareBazaar
TLSH T157A4E3D1F69EACDDED790CFB04F4A7D13C25AE2C0B019BD2A395399A877A2417C1C849
dhash icon 00ccd4d4d0c8d400 (7 x Formbook, 2 x Loki, 1 x NanoCore)
Reporter abuse_ch
Tags:DHL exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
806
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d56127ac43d4c1ae9399a842b7cec470
Verdict:
Suspicious activity
Analysis date:
2021-08-02 01:53:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/98d72655-e7c0-44d9-bc7a-ed8c0c40c6a5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/175662/
Detection(s):
SecuriteInfo.com.Generic.Cryptor.X.2E854BBB.31875.7429.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Launching a process
Launching cmd.exe command interpreter
Sending a UDP request
DNS request
Connection attempt
Sending an HTTP GET request
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7dd712a4-bf55-4c5f-8431-17c7e9e5e04c
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/825265
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: CMSTP Execution Process Creation
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 457675 Sample: DHL Shipment Notification,PDF.exe Startdate: 02/08/2021 Architecture: WINDOWS Score: 100 34 www.theharkapp.com 2->34 36 theharkapp.com 2->36 42 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->42 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 7 other signatures 2->48 11 DHL Shipment Notification,PDF.exe 2->11         started        signatures3 process4 signatures5 56 Maps a DLL or memory area into another process 11->56 14 DHL Shipment Notification,PDF.exe 11->14         started        process6 signatures7 58 Modifies the context of a thread in another process (thread injection) 14->58 60 Maps a DLL or memory area into another process 14->60 62 Sample uses process hollowing technique 14->62 64 Queues an APC in another process (thread injection) 14->64 17 explorer.exe 14->17 injected process8 dnsIp9 28 www.teentera.com 185.107.56.57, 49741, 80 NFORCENL Netherlands 17->28 30 www.thaipayakorn.com 172.255.209.118, 49740, 80 LEASEWEB-USA-SFO-12US United States 17->30 32 13 other IPs or domains 17->32 38 System process connects to network (likely due to code injection or exploit) 17->38 40 Performs DNS queries to domains with low reputation 17->40 21 cmstp.exe 17->21         started        signatures10 process11 signatures12 50 Modifies the context of a thread in another process (thread injection) 21->50 52 Maps a DLL or memory area into another process 21->52 54 Tries to detect virtualization through RDTSC time measurements 21->54 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2fcedf25cd8c0df5db7864ff3663f6a923eb3cdf1a30619a2eeb69df58e1c4f1/
Threat name:
Win32.Ransomware.Cryptor
Create hunting rule
Status:
Malicious
First seen:
2021-08-02 01:34:06 UTC
AV detection:
19 of 46 (41.30%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f7hn6jonrqg7lw3ymt7tmy7wver6wpg7diygdgro5nu56whbytyq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
3638ac885ef63f3b5bfadd95b0f43c34c3854e2483adde873b3d5fca7a831632
Formbook
489e0e46a5df58a3144cd7a3ecb1fd0e29aa2db5060084ec774f1d2c8c763fd9
Formbook
6c6dd45a923d7eb6fa1f114a5a4c20fab27bc03e44a5c8cb8627d43da93dfe48
Formbook
87ad57ffa31e9b3481663bd81249ec1e563dc2931bb4bb2045b06ea7917f1593
Formbook
88a982fd729f861a4439a59e632a7d76eb033991c437a2368bc2a834873f1f8a
Formbook
91fa1797421a3393289ae3892d128158ca3a16efd453be49e0c38d5891deefba
Formbook
abb1db77386f0eb3cd2c68603ee8817d6d1015287422182845345dad70503564
Formbook
b840f470d0cb4edaa85663b15f539593e3c31d81cec9e9ed1bb1c2539fc8d20c
Formbook
f96442a26d160132827a3b109acadaf4aad9dab625939103677cc93783c93ea6
Formbook
+ 7'191 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat suricata
Link:
https://tria.ge/reports/210802-gs58xnr6zj/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Malware Config
C2 Extraction:
http://www.sutsci.com/d8ak/
Unpacked files
SH256 hash:
f1098cf2ae8172065704ec8de1019c12ad33f32702a85de4cf0d031b9ecffb4f
MD5 hash:
93ce48f18608490a9aa3dce9a0db8d1d
SHA1 hash:
be8942eb02cee58663c7db1b1e14d08e77abd406
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/6b8f3478-5dbc-4fd2-8662-3b2e2166d010/
Parent samples :
2fcedf25cd8c0df5db7864ff3663f6a923eb3cdf1a30619a2eeb69df58e1c4f1
42081326f379275d4b731f76f2d932cd72cd2c404ed654ee281b66b08e59f6f7
9b985974efb3d7555b61cec77f2667cd6aca5f74a07f712b3aa58a54aa03bebb
ea38a026b9c1764cc7e1028c9674c2cb6fef4c4861ba643976c686ea79d040f8
8c0e95028944337b1e8a9e8dcc4ba141b535a4ee7dde151ca464238976039337
SH256 hash:
2fcedf25cd8c0df5db7864ff3663f6a923eb3cdf1a30619a2eeb69df58e1c4f1
MD5 hash:
d56127ac43d4c1ae9399a842b7cec470
SHA1 hash:
584467a584fc8dca18a170046f9211dc65411063
Link:
https://www.unpac.me/results/6b8f3478-5dbc-4fd2-8662-3b2e2166d010/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2fcedf25cd8c0df5db7864ff3663f6a923eb3cdf1a30619a2eeb69df58e1c4f1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/175662/

Comments