MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3952885137990ca32792a03dafe9420b4b2b1a103171239dcae3c69968800ae0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | 3952885137990ca32792a03dafe9420b4b2b1a103171239dcae3c69968800ae0 |
|---|---|
| SHA3-384 hash: | 1d493b6f37b9b73e3aed5235ae9251f1de2216c642dc2f8cb02bb8036c994f30ccfd56932cd8556ee8486986524bbc4a |
| SHA1 hash: | bbfad9f7e697c608ccce8c5c4dfbb829cf80674a |
| MD5 hash: | b3d1e1f0f7706e614de7942cd50a0432 |
| humanhash: | princess-coffee-mountain-lactose |
| File name: | 3952885137990ca32792a03dafe9420b4b2b1a103171239dcae3c69968800ae0 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 702'984 bytes |
| First seen: | 2024-04-04 14:20:09 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:xqs3/5dHLHY3U3rDyr/FQKHB9oJtjj4yJxtcQAm+3Fk1y1kxPvJxeekR:8wBR5wcJtP4yrt5KFk1y1CvJxeF |
| Threatray | 290 similar samples on MalwareBazaar |
| TLSH | T134E423423358B653EF7F2EB660F540067F3B64AA1D55D16C3DAA31460DE3A28AB1C21F |
| TrID | 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4504/4/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| File icon (PE): |  |
| dhash icon | c496baa4ecbaa6c4 (14 x AgentTesla, 3 x Loki, 3 x Formbook) |
| Reporter |  adrian__luca |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
330
Origin country :
HUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3952885137990ca32792a03dafe9420b4b2b1a103171239dcae3c69968800ae0
Verdict:
No threats detected
Analysis date:
2024-04-04 14:19:55 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Launching a process
Moving a file to the Program Files subdirectory
Replacing files
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
overlay packed
Verdict:
Malicious
Labled as:
Trojan.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
MSIL Injector
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2024-03-22 06:23:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
23 of 38 (60.53%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 280 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
00c1d9b4cb70d7412e4521566a428e48022b4c485c66d01a563f241e52886632
MD5 hash:
1141828010849f7af98d619ffb6b28b2
SHA1 hash:
bc470a002d842d2d0e692d986b8ff1bf33d3ba89
SH256 hash:
e2572bea802134bf82fed6a77c49f907f3c9cfaca991c8ab6a3b6fd51e311ef4
MD5 hash:
20ddbcc0c03b35d80536e1e858b1c917
SHA1 hash:
a71d08d1f6a2795005b8dc16feaf8ae5f6d42aa8
SH256 hash:
8c5bf9d0fe06f444cd02582ba9242eb9320e2e8e99834520ae137b4f71be1744
MD5 hash:
1f9ac6f5e912d4edc4bba311d962d643
SHA1 hash:
ea049456bf08008ec0c7446e95a39b8a5c99b943
SH256 hash:
8a42144bfaed7278d478bb226c64cfad8abd909f2f4ce18ed17018eebbd590dd
MD5 hash:
10f2dcb1aa3ec0d37027968d347b257a
SHA1 hash:
b2d1181f17169f535a8bfa614c21aab23260155b
SH256 hash:
7cfce9d4374f24d233171eaff3aa995d700542bf0a9fd54f183745647f450c4a
MD5 hash:
aacd3a7a18721a1a5e2aac83bfedc3c9
SHA1 hash:
2743a9077e031d648c206c00bc0fa38f9e0dab38
SH256 hash:
3952885137990ca32792a03dafe9420b4b2b1a103171239dcae3c69968800ae0
MD5 hash:
b3d1e1f0f7706e614de7942cd50a0432
SHA1 hash:
bbfad9f7e697c608ccce8c5c4dfbb829cf80674a
Detections:
INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables signed with stolen, revoked or invalid certificates |
| Rule name: | maldoc_getEIP_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | PE_Potentially_Signed_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.