MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39d7f0b102aca1db8c71a3a7af79ece2aa2100dbaf1c20237d75e36271833ef2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39d7f0b102aca1db8c71a3a7af79ece2aa2100dbaf1c20237d75e36271833ef2
SHA3-384 hash: 730d1b00c0387ec6695344d58c0e4c30173e959b8317a96f90cb32c9ca0b7e820f8dcce53b85e4ac25bd6bdc81040f6c
SHA1 hash: 07c8af14acd55fa65c80537bc7be9041ddd7b808
MD5 hash: c51efc503f561d465386699c92e1db7c
humanhash: lithium-carolina-timing-quiet
File name:copia_rapida.pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:973'312 bytes
First seen:2022-03-23 17:22:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'642 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 24576:ImkRbZIHaOSxAYmyLa+HYgLRtxkXdkboJUrIWwe:VEIHT8kyL/HYAxk1JgIW
Threatray 14'616 similar samples on MalwareBazaar
TLSH T16D2523D7BAD4C712D97C67BBD035D8500BBABC937102E76DCD8180A568433E29FA684B
File icon (PE):PE icon
dhash icon dadadadaa6a6a6a6 (12 x Formbook, 8 x AgentTesla, 5 x SnakeKeylogger)
Reporter Anonymous
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
206
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/256737/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Searching for synchronization primitives
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/962998
Behaviour
Behavior Graph:
n/a
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/39d7f0b102aca1db8c71a3a7af79ece2aa2100dbaf1c20237d75e36271833ef2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-23 13:49:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hhl7bmicvsq5xddruot266pm4kvccag3v4ocai35oxrwe4mdh3za._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
190b1831c5dfcd818fb3a4ff19a5a0ebfdaec9598e71c7a8c9f56f6ac9e52c6f
Formbook
2bb47abc0ec7e4e48aa80d53e19056c6adbef6b1392b3816aa335364325870fb
Formbook
3621aded8ecef2d269382fa26ea42d634a89f6d31de2529207da8024dec74226
Formbook
3f0b6a2e50e39420c7b91acb35c08bb088c1ccaaa889491559a572dc481bf489
Formbook
9f085df3f1da75ba799ca984603fe267f891be8e6ac24c52b907cc97e6879467
Formbook
b7abbe227ce2d0bb2c611e6e5b67e220261a5f2218ef18b22e3a794789cb1bfc
Formbook
c86f3a2110ed2a8498cf30d4ab88cf9ea18edc612835fe2b369e7596dafb802e
Formbook
ca77df966e202e0eab6d3c2280f95fb59aee28b5e9e540be3dca1d66c46bf2af
Formbook
df1510f64189b49ffeb4630c74af81a86888114102b493f52b5ad1c1cb58d121
Formbook
fce51b6f1f69629c651dfaedbcdcb55d25da39e8184614c1cb26e4c247f6d3ac
Formbook
+ 14'606 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:uevb loader rat suricata
Link:
https://tria.ge/reports/220323-vx5d6adhem/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
cf94621b95fb00832091b2ffefc33fe6eea66a5833d44f8579914dd3ee64b16b
MD5 hash:
5296fea48fa3a85b331a1e0e25463038
SHA1 hash:
5c0bdc7860d2f86a53ebad4c0052cd07ecfd4257
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/353d0498-0325-4ab1-a5ac-b70609de23c4/
Parent samples :
39d7f0b102aca1db8c71a3a7af79ece2aa2100dbaf1c20237d75e36271833ef2
633ac5a73a9076ffd9d4a97b1aaa18b624af84149ccdb3898ae3fd6c3b0b8abc
SH256 hash:
dc5c057b0ee1eb079cf189762aac69f0d86338ea18795dc4fbf7ed9b5a45c2eb
MD5 hash:
4103ed94f4747b30e166cf3c25416f47
SHA1 hash:
d553a67056e94f60d621ca42dcecd6d93f9ef1ad
Link:
https://www.unpac.me/results/353d0498-0325-4ab1-a5ac-b70609de23c4/
SH256 hash:
187a44736042769594c3848f9d7df1a8f33e86eb754bb28635e56c08121a658d
MD5 hash:
4b912d97a185688bfbae7add12226fac
SHA1 hash:
8129d270230ca9446cb3605d0d302e9912e29ee3
Link:
https://www.unpac.me/results/353d0498-0325-4ab1-a5ac-b70609de23c4/
SH256 hash:
70a217d33852203aad07bd56f46241bdb875682d0f731e3f7e2093512f9e065e
MD5 hash:
382b0fe0fca70bb11ee13990aa0fc42d
SHA1 hash:
7959d466fea5b8cbfb56dec896e7d3228eb7bb84
Link:
https://www.unpac.me/results/353d0498-0325-4ab1-a5ac-b70609de23c4/
SH256 hash:
39d7f0b102aca1db8c71a3a7af79ece2aa2100dbaf1c20237d75e36271833ef2
MD5 hash:
c51efc503f561d465386699c92e1db7c
SHA1 hash:
07c8af14acd55fa65c80537bc7be9041ddd7b808
Link:
https://www.unpac.me/results/353d0498-0325-4ab1-a5ac-b70609de23c4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/39d7f0b102aca1db8c71a3a7af79ece2aa2100dbaf1c20237d75e36271833ef2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/256737/

Comments