MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39f7d2aa6bd4b9aa4854434d59309e3fb16bf91b6b204bfbaa1fc0ad6d452f8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39f7d2aa6bd4b9aa4854434d59309e3fb16bf91b6b204bfbaa1fc0ad6d452f8e
SHA3-384 hash: 93a68d74b3a5c8e6698060915bb67a803c5150a0a3a6775d566b74366bc6eb226cb210faa1efcad8dc9a0fd496c1ff60
SHA1 hash: 6230352078dee3716f6d95eb8cd3a91963e458c3
MD5 hash: 44de2471096289379cf30cef69e2d35f
humanhash: bravo-ten-seventeen-fruit
File name:44de2471096289379cf30cef69e2d35f.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:924'672 bytes
First seen:2021-08-05 18:31:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:NvDBlBPIOBPHmkToc/ia9oFRw+tfkzfRLNJ:5pPDPHXscaLFRwyfWRRJ
Threatray 119 similar samples on MalwareBazaar
TLSH T1DF15F1263227A208DC3587F55C24C1B17BBEAC2A926CC6782DC8ED7F7D736B85AD0541
dhash icon 33b2e861f0b33012 (5 x AgentTesla, 3 x Formbook, 3 x Loki)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
346
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
44de2471096289379cf30cef69e2d35f.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-05 18:33:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/03a63d0c-6f17-48ca-a772-7dac49cd8954

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/176801/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.935-1.UNOFFICIAL
Create hunting rule

Win.Packed.Pwsx-9880527-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/06e9107a-2a57-4e91-ad81-2afdae9d285b
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/827655
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 460088 Sample: LTprZGLmJV.exe Startdate: 05/08/2021 Architecture: WINDOWS Score: 48 16 Multi AV Scanner detection for submitted file 2->16 6 LTprZGLmJV.exe 2 2->6         started        process3 process4 8 WerFault.exe 23 9 6->8         started        dnsIp5 14 192.168.2.1 unknown unknown 8->14 12 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 8->12 dropped file6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/39f7d2aa6bd4b9aa4854434d59309e3fb16bf91b6b204bfbaa1fc0ad6d452f8e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-19 13:41:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
29
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e
Formbook
4072fc745ae1b976bfff8fdfdebdac6db5e33bb4f63507b4d56ab67b98c6db65
Formbook
9c896697f053fc353c7263676f9a6aae0ff85054358dd07ee888f18edee17be4
Formbook
c224e597b165da77d8555c2d28901b3526dd5369f0b89b4cd4c798c18a088c16
Formbook
c25e2223ce02406f44264119d1cc1aec651d903991ecd91fb848a912fb1e349d
Formbook
cd36c2fd2964a7c6a5c20dbf905e4e1bd28aa8e168f2fa50ff2891adcd5d1825
Formbook
d3eb7e966bf389f4139c625dea6d218f0969440101629a0e11302d0e547dee85
Formbook
e18a890697a25ee3b0954c15463e17a4ec515428359c5040f603758cc01c3cea
Formbook
ee8cb2212b511830647dcb59d321714d9b2a18ffa2c983b8f17e6cd049adf0fe
Formbook
f4eda49ca8e4098cd24842ef3b8c0ac249e10fd106c8c59815a3af3b1bf96778
Formbook
+ 109 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210805-lel8yecrq2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
83d9e44d9a311ea6fdbcbd09fdc816a2067806dcacf24beb5ee786191b1a3ea1
MD5 hash:
b1a7b752b6638ee03cffe5a1dde9213e
SHA1 hash:
52d215a173d2f293990f8c12fc7f4a86330a29cb
Link:
https://www.unpac.me/results/ece0674c-01fa-480f-8125-50fb3900e2c6/
SH256 hash:
272fa476f191ea10f5f4c57d80726c83e56c599d405adbdb13ecb506000c4f8b
MD5 hash:
eebe35eb6868a80782c286d48b763d7e
SHA1 hash:
8113e2844f64c3fd469d1c078423d64e267b34a7
Link:
https://www.unpac.me/results/ece0674c-01fa-480f-8125-50fb3900e2c6/
SH256 hash:
1da0ada243e122197383a7c873ea44a7af6fd359f9f0af4c3dcd2808d382554e
MD5 hash:
517ac8416e18884f8a2492b4f650d2b5
SHA1 hash:
db483756944750a4ef2c1eafee06a297704c525e
Link:
https://www.unpac.me/results/ece0674c-01fa-480f-8125-50fb3900e2c6/
SH256 hash:
42cf8b340eaf4a971d7e5b63ce65ced11e01efa1c080f3f23656e3037038973d
MD5 hash:
5fb5fb990e49f76b6a547fe5800b08f3
SHA1 hash:
3c92c639b1f2a72c2eb3a9bb9213fc98d346746c
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/ece0674c-01fa-480f-8125-50fb3900e2c6/
Parent samples :
1b6c5d0594eeb43cf5d85002be1d2dd0f0b6555ca114c73b62215c58cde3cb54
4881e3adf30b0665cdbb38cb90ae0bf3a3395d2f9a4e19daec9c3d6beb2e915a
47c700a9a4cc5589c3acd273c4536952c5c0db7ad1f94408b4e6097d48fdb581
39f7d2aa6bd4b9aa4854434d59309e3fb16bf91b6b204bfbaa1fc0ad6d452f8e
d7d35002f25eb13d14a68f466db5679be33e14645a4079d242ac488c35531988
e99ee0d03ae293aec74c31a6db628d9fe12be9699365ebf71de4b2bf6e8ca0d5
5f001974075d3d3ae0b25e4ae5e5231c807fc36db1836d8b53f3d0624e09598e
a57534ac7570e5be7e25f1c0d9745dc549d56b193ed7b1547e61ae79485edc1c
SH256 hash:
39f7d2aa6bd4b9aa4854434d59309e3fb16bf91b6b204bfbaa1fc0ad6d452f8e
MD5 hash:
44de2471096289379cf30cef69e2d35f
SHA1 hash:
6230352078dee3716f6d95eb8cd3a91963e458c3
Link:
https://www.unpac.me/results/ece0674c-01fa-480f-8125-50fb3900e2c6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/39f7d2aa6bd4b9aa4854434d59309e3fb16bf91b6b204bfbaa1fc0ad6d452f8e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 39f7d2aa6bd4b9aa4854434d59309e3fb16bf91b6b204bfbaa1fc0ad6d452f8e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1508984/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/176801/

Comments