MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 313e2f2156f10a56f115e96b9efb094dc6db5cfdfe4fd22fdb17aecf6aee07c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 8
| SHA256 hash: | 313e2f2156f10a56f115e96b9efb094dc6db5cfdfe4fd22fdb17aecf6aee07c2 |
|---|---|
| SHA3-384 hash: | a2803a925befe7548d14bd0472c42f855e0bd7d3ef7e16bf8c054b1dd819205f978c309df5c198e125e72aa4ab6a7bbf |
| SHA1 hash: | 54341341e36a20851d9521828087bc79255ee4ea |
| MD5 hash: | 5bf99ace685c1c91d73d4852fb50afc4 |
| humanhash: | wyoming-five-virginia-vermont |
| File name: | INQUIRY No-6674 -290920.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 356'442 bytes |
| First seen: | 2022-02-28 18:38:57 UTC |
| Last seen: | 2022-02-28 20:48:56 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla) |
| ssdeep | 6144:rGiw5SPaIKW/qvDUlqSfF4aIwypgsb6t7R1fPMJyka3OHr+ZLaLK2F3fldiCWsFg:00DMDUcSfmaEzb6t7bxkPHrq+LK2F3f8 |
| Threatray | 4'324 similar samples on MalwareBazaar |
| TLSH | T1917423AADAE49C3BDA7329714B7AC6B8F3B722DC5211510F0F4C1FB71E13A968025716 |
| File icon (PE): |  |
| dhash icon | b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla) |
| Reporter |  GovCERT_CH |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
232
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
control.exe formbook overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Signature
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.FormBook
Status:
Malicious
First seen:
2022-02-28 01:42:33 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
21 of 28 (75.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 4'314 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
n/a
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Loads dropped DLL
Executes dropped EXE
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
4e22032813d3edd86e5f54f424dbf0109fc46948b3ee5f172f8d811a5b8da020
MD5 hash:
0caacf759e7ad040c77990f9bd88bc9b
SHA1 hash:
7f0b0ff8f3f6d4afee16a63ec34d0c99835b92a0
SH256 hash:
313e2f2156f10a56f115e96b9efb094dc6db5cfdfe4fd22fdb17aecf6aee07c2
MD5 hash:
5bf99ace685c1c91d73d4852fb50afc4
SHA1 hash:
54341341e36a20851d9521828087bc79255ee4ea
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.48
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.