MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3815ca6154be713f81652e9590d81940c50ecf06491ed4a493d5e2df2d110d4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | 3815ca6154be713f81652e9590d81940c50ecf06491ed4a493d5e2df2d110d4c |
|---|---|
| SHA3-384 hash: | 0b4c00e698410f561292445fe99fd1c1bc8f5d7cb026352d9638dd496d37a0b539fca280d48651747ab433917b8f0771 |
| SHA1 hash: | 6405ab10799b0292c51a071f14ac55dcdfcfbd32 |
| MD5 hash: | ef89d947ff3c0a22345d59cbc99cd610 |
| humanhash: | carpet-foxtrot-charlie-apart |
| File name: | SecuriteInfo.com.Win32.PWSX-gen.9647.26439 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 763'904 bytes |
| First seen: | 2023-06-01 03:27:26 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 12288:p8axE9EP/SJadxDsnBF9QaikncQR/Be2Snh8YqT0dFI2cloo1i51zllPeA:pMU/42dCBF+aNncQ1BeNSYA+Zo1i5Vlf |
| Threatray | 2'907 similar samples on MalwareBazaar |
| TLSH | T190F4011433EA4A1FE67A2BFE5E205130CBF5654A2567D2DF1F83249E8FE2B040E81657 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | f0b2b26868b2b2f0 (8 x AgentTesla, 2 x Formbook, 1 x SnakeKeylogger) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
272
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.9647.26439
Verdict:
Suspicious activity
Analysis date:
2023-06-01 03:30:17 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Leonem
Status:
Malicious
First seen:
2023-06-01 01:50:51 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
20 of 36 (55.56%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'897 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
2f952a6dd6e6d39abcc1ecf148e34568d496d8065eb959e0700bd54654ffa828
MD5 hash:
f2ab90fc4f6144b4b6e77c31c3dee6f3
SHA1 hash:
a5e7fd665123fefaefae7fdb436c7e51387c221c
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
30e01dd96bb572090e05d6d64e0b9dbe766fc483c4b43cb9488ad9fc95eee464
MD5 hash:
135a73116225e6e223172aacb2fb5b1a
SHA1 hash:
8a327cefd84a54ed65629508c714e7ff4913dd1f
SH256 hash:
3214ce6d699782a1bfcca1a5f01137de8c7d5c377d7a4208775f2ed8c2478304
MD5 hash:
bcee068cbec8334f277bcfe996548f6b
SHA1 hash:
f3d28a05ff6a88269df288ccc4a174822947a750
SH256 hash:
2a6144b420ebba5890ee608140a884805f7eb9b68899bfbc620488d51dc53b24
MD5 hash:
7393235514de9357a65077a064b1c7c6
SHA1 hash:
88cbc7d54a9bca6c39ed7758016eec47eca4191c
SH256 hash:
90abc1235306796e82f284392509f1cd6c9150b8fa2b93b5cd976537462c7b53
MD5 hash:
363cc1ac1fa18f653a353d6e8cbc18ae
SHA1 hash:
63670df5c3909c16060eae0e74b491f1985ea37f
SH256 hash:
2e5c68014d00cea3fcc41b27e46daee9a48488f56d4bf340fa4c391a0e21a3ec
MD5 hash:
311f990c9b782ce7eda4d3a46a016509
SHA1 hash:
0ecfc4464bc30bf505e16b1bfe955997c5e79326
SH256 hash:
3815ca6154be713f81652e9590d81940c50ecf06491ed4a493d5e2df2d110d4c
MD5 hash:
ef89d947ff3c0a22345d59cbc99cd610
SHA1 hash:
6405ab10799b0292c51a071f14ac55dcdfcfbd32
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.