MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 35a10de4741e23670aadd4aa19babf2ab5b8f134c0df0050eaf2255b6d90c053. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 15
| SHA256 hash: | 35a10de4741e23670aadd4aa19babf2ab5b8f134c0df0050eaf2255b6d90c053 |
|---|---|
| SHA3-384 hash: | 4395729a5e5a9753075489978dce87b0bdb0f8cd6686c27555ae543c1894957d5e907c67e7da8b3650f27bdbbb9e914c |
| SHA1 hash: | 6ed15b4b9cf18e3949309693bf71998dc2883806 |
| MD5 hash: | 1295cd68c9274daf773810630e5c017e |
| humanhash: | georgia-violet-may-arizona |
| File name: | PDF.New OrderCIFMetal Product.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 1'002'496 bytes |
| First seen: | 2023-06-17 15:11:00 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:sQbicrmr8thRQVE7d5kExiNVz4qXdVjZ:sEi4C8XReE7dSNV4qXXZ |
| Threatray | 1'538 similar samples on MalwareBazaar |
| TLSH | T145259DDE02F5111BD56947F4A955AFF01BA1ECB97A22C3197D40FCCEAE323E144226A3 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | c4bada9ae8cca4c8 (13 x Formbook, 6 x AgentTesla, 5 x AveMariaRAT) |
| Reporter |  threatcat_ch |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
312
Origin country :
CHVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PDF.New OrderCIFMetal Product.exe
Verdict:
Suspicious activity
Analysis date:
2023-06-17 15:12:58 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
floxif lokibot packed virus
Verdict:
Malicious
Labled as:
Trojan.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Leonem
Status:
Malicious
First seen:
2023-06-14 08:26:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
26
AV detection:
23 of 37 (62.16%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 1'528 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
85b0f6233dc470dfd3aba432608ddac441a680b902ca94ec612d7db3a261d615
MD5 hash:
18c7f2be7f6bd3e1dcc4a33ba9860d4e
SHA1 hash:
f1f25d5e3ea989f13428acccaf37442554959ee1
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
1809be0e2f03ff05b81fc97140c9196f7996dba56c09a3b9515f603148d2fb8e
MD5 hash:
aa27dda6f3ccfd8b309aa251c975efa9
SHA1 hash:
9939d17ff5541fee4c099019852820208ae68897
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
SH256 hash:
d6d27ed1939b8527bfaab77b5cda589e3cdc842639958f7b4b63aed35ac7a7ab
MD5 hash:
72b601a1609673f221ca537200e6f074
SHA1 hash:
9bd391169223d5d967cbda11e237b68204cb8511
SH256 hash:
a53db16363e908c6a2a89cc1d2257582d7b3daf3dca5229ef17d546072e99ea1
MD5 hash:
2c0f82b0f202bd0d28661c4428b834c8
SHA1 hash:
6ef510a969b6f1dfc74a4be0a8cba9ee848d6865
SH256 hash:
7faccae554013004fd4205592dfede0f92f4afb9f7af22302f70ae9a54bd42d5
MD5 hash:
5859a394b7b90b0a98ba59bc3e1234cb
SHA1 hash:
2cea325819d7543d2690ffb9466e6ea5d8c7f5b7
SH256 hash:
35a10de4741e23670aadd4aa19babf2ab5b8f134c0df0050eaf2255b6d90c053
MD5 hash:
1295cd68c9274daf773810630e5c017e
SHA1 hash:
6ed15b4b9cf18e3949309693bf71998dc2883806
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.