MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 375023474e1cf7831eae2918f7dd925a8fbc310986a063a00d91a31a07f15f7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 375023474e1cf7831eae2918f7dd925a8fbc310986a063a00d91a31a07f15f7c
SHA3-384 hash: 0f40352a62e17b748c67c5da153be3fb6145fd3f8cbed9a8b75f092c7155950a6ec917523de243f86aa6c5f1fb9ebe92
SHA1 hash: 1d7cd48b70852c3bb9fd30c32ce4ccbd0afea036
MD5 hash: c8db875440a55914ded0650d8956858e
humanhash: charlie-india-video-virginia
File name:Documents.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'025'024 bytes
First seen:2023-03-02 12:17:03 UTC
Last seen:2023-03-02 14:09:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:dMuVADz1KGRbItyZMxQUjrionGX/J7/KwfDSnEyODmbP52PecGQnWi5I0qUaijcl:iBMxQCNno9lfDSVeml2WknWiDjY
Threatray 2'762 similar samples on MalwareBazaar
TLSH T19E259DC677BCD122F8EBA1760A1411CA3A39B987B211F53BA737BB158201BFF7685540
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter cocaman
Tags:exe FormBook INVOICE

Intelligence

File Origin
# of uploads :
4
# of downloads :
193
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
Documents.exe
Verdict:
Malicious activity
Analysis date:
2023-03-02 12:19:43 UTC
Tags:
stealer formbook trojan
Link:
https://app.any.run/tasks/adfdaab1-d8d8-4c3f-87ee-7fcb1138efd4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/371155/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen3.27084.32334.19186.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Launching a process
Creating a file
Searching for synchronization primitives
Launching the process to change network settings
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed strictor
Link:
https://www.filescan.io/uploads/640093fb0e8ce4beca2580f2/reports/48b364b1-5009-4d77-b226-ae165bb85820/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/375023474e1cf7831eae2918f7dd925a8fbc310986a063a00d91a31a07f15f7c
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/47ebb91c-c825-48f8-a4f4-325ded9b6d3f
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1185696
Signature
Antivirus detection for URL or domain
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses netsh to modify the Windows network and firewall settings
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 818561 Sample: Documents.exe Startdate: 02/03/2023 Architecture: WINDOWS Score: 100 29 Snort IDS alert for network traffic 2->29 31 Malicious sample detected (through community Yara rule) 2->31 33 Antivirus detection for URL or domain 2->33 35 4 other signatures 2->35 8 Documents.exe 3 2->8         started        process3 file4 21 C:\Users\user\AppData\...\Documents.exe.log, ASCII 8->21 dropped 11 RegSvcs.exe 8->11         started        process5 signatures6 45 Modifies the context of a thread in another process (thread injection) 11->45 47 Maps a DLL or memory area into another process 11->47 49 Sample uses process hollowing technique 11->49 51 Queues an APC in another process (thread injection) 11->51 14 explorer.exe 2 1 11->14 injected process7 dnsIp8 23 traumlichtfotografie.com 81.169.145.159, 49713, 49714, 80 STRATOSTRATOAGDE Germany 14->23 25 www.42230.org.wcdnga.com 163.171.128.148, 49711, 49712, 80 QUANTILNETWORKSUS European Union 14->25 27 14 other IPs or domains 14->27 53 System process connects to network (likely due to code injection or exploit) 14->53 55 Uses netsh to modify the Windows network and firewall settings 14->55 18 netsh.exe 13 14->18         started        signatures9 process10 signatures11 37 Tries to steal Mail credentials (via file / registry access) 18->37 39 Tries to harvest and steal browser information (history, passwords, etc) 18->39 41 Modifies the context of a thread in another process (thread injection) 18->41 43 Maps a DLL or memory area into another process 18->43
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/375023474e1cf7831eae2918f7dd925a8fbc310986a063a00d91a31a07f15f7c/
Threat name:
ByteCode-MSIL.Spyware.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2023-03-02 05:40:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
22 of 25 (88.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g5icgr2odt3yghvofemppxmslkh3ymijq2qghiansgrrub7rl56a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1429c1abb9518085745981f85593eaab6a5712ee9df8324e4e10e0b1bd42d54f
Formbook
27715b211a7693bd15a4580b6ee1e9b9d01c2b1142170b47888b7be538ecb084
Formbook
2e5a68487fb25640fbf7d4c2529e17bb20b2c948b82e464e9543a25f34027176
Formbook
3e677355817c5d7cf457b670c028523f420442374463e5aa23f5c195ae290472
Formbook
7fd5172067f790c21d11dc37987f04bbe9e4c04038074b788ac79bcc83c06f1a
Formbook
d14a33d70b8d8be176eaf739c6c51a2835a2856f446b975b5d13727a925e1738
Formbook
d1613f6ca68cdd7b490e9c42b1abc4b5c71aadf146977bdfc3f4d33d2d33159d
Formbook
f3197cca74f60c552d9d3b4d04d99996ceca8c8dc6ad845a468c10c65062a0fc
Formbook
+ 2'752 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230302-pgldfscg93/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Unpacked files
SH256 hash:
ef3c7bf77e06f90c5fee8f82de30d15cde347504601a2f4a4da5c808fda3d146
MD5 hash:
d721abd1774d5d25c516645d1613380b
SHA1 hash:
1d6ea57141f658bfbcbfa9f30cff02639897a9bd
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/5c52ebcd-6b62-47e7-abcc-94ded0a571a9/
Parent samples :
7fd5172067f790c21d11dc37987f04bbe9e4c04038074b788ac79bcc83c06f1a
375023474e1cf7831eae2918f7dd925a8fbc310986a063a00d91a31a07f15f7c
d1613f6ca68cdd7b490e9c42b1abc4b5c71aadf146977bdfc3f4d33d2d33159d
e92f7d954c97723d975ffb5d04438494d692c6bd3b552a24d826e13ae6252ef4
aa5548a9ee7fbe66cbff5c8488bd260ee5377818faac895fecf519fc0bdf453b
ac8157f89fe4d01eb6e009147f4e6a3b64ebd924af77f4c4999b7dba22b53e4d
13c4ed220256fb2dfb95631c042d9eadf977bd2dc5e4aa0898ab99bd16d33ef7
07ea5734d5a27eec2e18629559643c25f87676c8f81f9abe12aebf742dead0d1
07843e27993206a92d9e0bfbb249332fcfedad068bec8f7f7f3f318654c7910c
ae2e5e556f6fab620a62ed8dfe072e73ebff0a207177e48cb3b65253055205d4
ac61c80f02e15eb3705836ff8dc9d81543eb0e26059d4aaa9b0895c716deafe4
b153cca3bac87165e94ba9851a895ee316e0b9876795c1216388715a01b45674
179b98e2cb16a094755f853ae892b47948a8b6a83e7ca050d520e113ff180b2f
1bf1d7519eb3538201392d2bc32be1ebf4e2cd720d637bc94a67d0765f6a645a
fe7957318166dd7147d4b7b42360f9369f0657308fa68f929d573d4ac99aed9d
40d4375902fce141fe2e90e675790acb6b8f3d98fb2a53a90aa18cbd629a51ef
SH256 hash:
c5f46eae4c3daf89f723d9a0ed54928319b429e8e6b7e090b6d9887a7f8ef56a
MD5 hash:
efb0011b5da4e019d914f3c0ab18f002
SHA1 hash:
0be02538e44f1a12f5b61d90c94f9bd20c562813
Link:
https://www.unpac.me/results/5c52ebcd-6b62-47e7-abcc-94ded0a571a9/
SH256 hash:
d8ec03c34a5f3bd93effeafc2e078ade5df75d468dae5208937c69be4fecfe7f
MD5 hash:
cd4b7952d18e1459bae379e5da7f6afb
SHA1 hash:
e09367a20c19427dae20b53cbe761d1b21272c36
Link:
https://www.unpac.me/results/5c52ebcd-6b62-47e7-abcc-94ded0a571a9/
SH256 hash:
720952a2cfae1931a1842811312655f3670b5bd2864f9397afd23b6459e05beb
MD5 hash:
356415a1b91f2e4361417775f2ea78bf
SHA1 hash:
d95e6ce462a2f334f3ca9f51b63c7ae2e85f1a60
Link:
https://www.unpac.me/results/5c52ebcd-6b62-47e7-abcc-94ded0a571a9/
SH256 hash:
a46998f03ca372f55fec7e4d4de698c5d128eea00502975bf7c337b0d3372640
MD5 hash:
2f5d6edb1b87947812a05ab362fe9a27
SHA1 hash:
4a48608fa247541aae9d2d31b85a2d6c9d191f82
Link:
https://www.unpac.me/results/5c52ebcd-6b62-47e7-abcc-94ded0a571a9/
SH256 hash:
4c1e05eb7925134539d9936d662caa8055b0f3e04df2cd0c139817c9184860b9
MD5 hash:
5d2bc2e03e1f4da1dfb57f7872f87750
SHA1 hash:
057bd0dbe290f12f5bd6e6e1fa9cc860cea7d849
Link:
https://www.unpac.me/results/5c52ebcd-6b62-47e7-abcc-94ded0a571a9/
SH256 hash:
375023474e1cf7831eae2918f7dd925a8fbc310986a063a00d91a31a07f15f7c
MD5 hash:
c8db875440a55914ded0650d8956858e
SHA1 hash:
1d7cd48b70852c3bb9fd30c32ce4ccbd0afea036
Link:
https://www.unpac.me/results/5c52ebcd-6b62-47e7-abcc-94ded0a571a9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/375023474e1cf7831eae2918f7dd925a8fbc310986a063a00d91a31a07f15f7c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 2dd6c6a9a7828559ab5f48660e27f21891c49dc5a3c728686c7ca7c36b5e415d

Formbook

Executable exe 375023474e1cf7831eae2918f7dd925a8fbc310986a063a00d91a31a07f15f7c

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 2dd6c6a9a7828559ab5f48660e27f21891c49dc5a3c728686c7ca7c36b5e415d
  
Dropped by
SHA256 54717ba1f9e1797ae55735cc5692472bf3652dc6d5fbec6470ee1ef3ee2f8fa4
Cape
Cape
https://www.capesandbox.com/analysis/371155/
  
Dropped by
MD5 cd2c81f26280b92ba9705d4ddb96c5a7
  
Dropped by
MD5 8f3eebb159c062e617ec919d195eb24d

Comments