MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34da43dd685ff44693360ea3feb0aba8946f7844a7711ed297533e51c2a7ec90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34da43dd685ff44693360ea3feb0aba8946f7844a7711ed297533e51c2a7ec90
SHA3-384 hash: 1e21b0205a5ed594f7946bda3c55a9ae4888c58eacf26c58839a25fe8b0ab3a0b015b8e9f7e4ee42b8e3518203874e70
SHA1 hash: f7af5a9f14cce10fef0b7e97212a05c41bee0c9f
MD5 hash: 57908a1f3f0a596d694baf2a9a746aae
humanhash: william-finch-texas-potato
File name:New_Product_Catalogue_2023.pptx.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:676'864 bytes
First seen:2023-04-05 13:01:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:D4tWXCxG/ZC5MAhNELarBrDOHxeGLitoqYcAGSfvF8R5RnQU9l:DMWXkGxCOAhrBaHxeZyqY3nXeRnnP9l
Threatray 2'512 similar samples on MalwareBazaar
TLSH T14CE4121C2EAC9129C2BF0F39C962150553B65C76A636E33E0ED5246E1E73B58E061FE3
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 4c3c6e6ce4a0c044 (5 x AgentTesla, 4 x Loki, 2 x SnakeKeylogger)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
237
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
New_Product_Catalogue_2023.pptx.exe
Verdict:
Malicious activity
Analysis date:
2023-04-05 13:04:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/477a0933-3a8b-4708-9300-892d4bfcd065

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/380304/
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.10051.12933.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/642d714c7dc0445b238915f7/reports/42ca4f91-a030-4ae3-80d1-eed9f3cf7544/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/34da43dd685ff44693360ea3feb0aba8946f7844a7711ed297533e51c2a7ec90
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1b04924f-2783-41de-ac17-839a82b20f8f
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1209137
Signature
.NET source code contains potential unpacker
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34da43dd685ff44693360ea3feb0aba8946f7844a7711ed297533e51c2a7ec90/
Threat name:
Win32.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2023-04-04 08:03:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
16 of 37 (43.24%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gtnehxlil72enezwb2r75mflvckg66ceu5yr5uuxkm7fdqvh5sia._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
015ac938d581a3af8e1d988e8a2a96fe502153b7cf90ee9e9224c6beb0238443
Formbook
490a16064d8639a4637f7ee3ac2ad7bdb5f1a4db1c6f4f42cc53d11f51878bb6
Formbook
837acf5c4bbc04842a5742b335994ff6eec7df1c1768cafb3cf7fa3aef3d5e0b
Formbook
970c4b831da818fc235548b2f0db7bc45b028e19edd91b9a0654a2e59e7071c7
Formbook
9c50fe80a314898db5b4849b8bf2523e6e943376a4832d1943d0c12d5e7d5b8d
Formbook
a1f4604ea58dce5c513639a0929b6e130783a85873bec08ab0e5b061736dd086
Formbook
b1e912ac090bab63fe0f4c5fe95a920afce1ed2a79b3bd7bdef6fbd8fb9f2031
Formbook
c3653e6517e48603a356a5978cdc1b210bd20e023146fd561c611c3b82c0736c
Formbook
e5a87b27c03e65abef7933af36a80813ec882cf63728b2d34e61e6d12ec84d98
Formbook
+ 2'502 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230405-p9sy1aeg88/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
36e9433fcfc24f9e553b1b7b260cd5819ee24ec3cfe6f1711c45d9ed39e0ac57
MD5 hash:
6044c416016ff29afbd44834d7769559
SHA1 hash:
623bc8ad49e7bcf7a9b442748a14f2067e37dfb5
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/841a1319-1282-4323-88fd-64b3f7dc76ca/
Parent samples :
91220ea3c0c0c29ff200847c1b57713f299e74c789cedaf4f0008981203f2995
74918059a600f724964e71c9c698e6d46090248c16f29909a9de9a8b290af4a8
c117bb5751dbaee9a3036d8481ede0d8f2b0049a1819d9cb61a8310d2e6fea5b
a1896f4eab7631eb5e0daa3a5a9a9787cbb5ebc2324f4823f96e3d565b4875e6
34da43dd685ff44693360ea3feb0aba8946f7844a7711ed297533e51c2a7ec90
SH256 hash:
7f1b882abcd8ae0854e55a31279380811470baed89161a5625c9ffb255edd1b2
MD5 hash:
40c407b2357867ced0bed9cd7358a14d
SHA1 hash:
549b085b96e3c68884d72d664afec370dcee5686
Link:
https://www.unpac.me/results/841a1319-1282-4323-88fd-64b3f7dc76ca/
SH256 hash:
c290578d8c0c6089e7bdf8eb50525961fb96ee47be935f947b5878f8336f512d
MD5 hash:
83e69e6975b4217652d2dadc6ec665a1
SHA1 hash:
ff5c89cfcfb3667408b34b6ff2c87437210cd220
Link:
https://www.unpac.me/results/841a1319-1282-4323-88fd-64b3f7dc76ca/
SH256 hash:
ec20bb2cbb58ecec077f62b366079bc73cb5c0d52d7bcfe72a8f11b47f533226
MD5 hash:
564d7c8847feac6d94fdcd1cb9aa5b5e
SHA1 hash:
ec180922fbe20ff2f08f67f3bf0021d13d970f2a
Link:
https://www.unpac.me/results/841a1319-1282-4323-88fd-64b3f7dc76ca/
SH256 hash:
224d7dacc8b588c1d3fb4c5f0e0ab543156aa98a247b00904af40f6d13fc3bad
MD5 hash:
143efef256dacfc35f3eb0e509594854
SHA1 hash:
bb418effee1e4da0d1dab6335a52f92117da81fe
Link:
https://www.unpac.me/results/841a1319-1282-4323-88fd-64b3f7dc76ca/
SH256 hash:
3c507afadbb1c31a9ebdd24baac5739d47576159e01c5e84f973c951885100aa
MD5 hash:
e79bf0e7e9d52d398e0b23b352394c68
SHA1 hash:
682325763a0ec77e0fd475ea3a4021b4651eceac
Link:
https://www.unpac.me/results/841a1319-1282-4323-88fd-64b3f7dc76ca/
SH256 hash:
34da43dd685ff44693360ea3feb0aba8946f7844a7711ed297533e51c2a7ec90
MD5 hash:
57908a1f3f0a596d694baf2a9a746aae
SHA1 hash:
f7af5a9f14cce10fef0b7e97212a05c41bee0c9f
Link:
https://www.unpac.me/results/841a1319-1282-4323-88fd-64b3f7dc76ca/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/34da43dd685f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/34da43dd685ff44693360ea3feb0aba8946f7844a7711ed297533e51c2a7ec90

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Suspicious_Macro_Presence
Create hunting rule
Author:Mehmet Ali Kerimoglu (CYB3RMX)
Description:This rule detects common malicious/suspicious implementations.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/380304/

Comments