MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 371e28a0c19d37ad3434d228175cd7268a0b8e382c809d7bbbd8e5664a553553. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 371e28a0c19d37ad3434d228175cd7268a0b8e382c809d7bbbd8e5664a553553
SHA3-384 hash: 16a0ff77a5677036446969e6a377881cf9be2477d5b2588340b73eb596f9d4e6c9a443f1010e86ae5b9d8a2130f0a037
SHA1 hash: 5d8e9ce6b2d20c45994d43cfc05ad88148e928af
MD5 hash: 4bc6453ec3985ca7a3de57a8a2264a9a
humanhash: island-equal-louisiana-network
File name:FedEx AWB# 8611746580734 ,PDF.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:241'152 bytes
First seen:2021-09-07 13:10:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5aac9416dafd435c25e06c0aaa4273a3 (3 x Formbook)
ssdeep 6144:u0QuookKQStQVvdGYrW9WOujCMICbXAPY8/sy:uPJKQrMYrW9WO6jY
Threatray 758 similar samples on MalwareBazaar
TLSH T16734BF68FED34525D17B067C95CB737AC1090F450A52225B6A6B30F3ACBAE35EA0B70D
dhash icon c0a09ce4e64a8acc (1 x Formbook)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
303
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
FedEx AWB# 8611746580734 ,PDF.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-07 13:13:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/79ef0803-28dc-482a-ae63-79069c21efb3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/186033/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader42.36852.19869.13632.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a window
DNS request
Connection attempt
Sending an HTTP GET request
Sending a UDP request
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4cb66cf0-a565-40e2-bbd3-4846fa02ed9a
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/846613
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/371e28a0c19d37ad3434d228175cd7268a0b8e382c809d7bbbd8e5664a553553/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-09-07 08:07:32 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
19 of 45 (42.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g4pcrigbtu322nbu2iuboxgxe2faxdryfsaj26533dswmssvgvjq._file
Verdict:
malicious
Similar samples:
0913bfa77bc5c9494eb3908544f69e4e1d8c9aeeaa26e35efe28e9fe43481a6b
Formbook
1cc1946825bf1c1c707ba6f27dea1ff8c212fc9192e8b794a7cf9da39ad00c36
Formbook
3c580f5beca53b6599e5f04d3aa68a34bd50521d7ec5d7163849eb69f53a4150
Formbook
3e22ce49e987a1d097778730877bd196bca1182772dbce70d75e109e1ed64702
Formbook
41c64c9b43a691e8c56957c426627c2b752e4d8294c060c71148c144510ade20
Formbook
4cb419b34caf346c3682e22c4981686033e6fc816f376deb89ac698771f55843
Formbook
8744b1bba11ed42a3e422599468f9d7aa117bf7264875591a82ebbf1dc4dbffa
Formbook
8fa36ce72b9ecd6dcbcfc55e44bcef14c1bd23c189c2929ac8a2474bd1d0cff1
Formbook
b84c172a230631c06d71bc1c55c8b3aa411adcac5e30a23097de8f70bdcbe978
Formbook
dfc761bd651db9fbcf544787fa5b982e93949fda88c7362f34c101f8446a32ec
Formbook
+ 748 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210907-qezczacfd2/
Unpacked files
SH256 hash:
371e28a0c19d37ad3434d228175cd7268a0b8e382c809d7bbbd8e5664a553553
MD5 hash:
4bc6453ec3985ca7a3de57a8a2264a9a
SHA1 hash:
5d8e9ce6b2d20c45994d43cfc05ad88148e928af
Link:
https://www.unpac.me/results/13488908-ce30-408c-8374-9761b50b2fa8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/371e28a0c19d37ad3434d228175cd7268a0b8e382c809d7bbbd8e5664a553553

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Embedded_PE
Create hunting rule
Rule name:Embedded_PE
Create hunting rule
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/186033/

Comments