MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d1445e540b8f4dfee869812cde4bf208bdfc2a28a510336924c860868c07c25. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments

SHA256 hash:	3d1445e540b8f4dfee869812cde4bf208bdfc2a28a510336924c860868c07c25
SHA3-384 hash:	0b9482548a40c168d67a91b37c1409753e4b5e4bb2f0174874d95808199aa7edbc90fe3eee71574d04a1f19b51e436e0
SHA1 hash:	b9de98dd0e8f7248ab9bc62ea77886a9ba43fb43
MD5 hash:	338a91f4a24b4856a29165df68847cde
humanhash:	harry-glucose-ten-october
File name:	Doc_93847332023.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	638'976 bytes
First seen:	2023-07-13 12:25:14 UTC
Last seen:	2023-07-13 13:54:52 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	12288:Sd+GLlrBXdavdUlynHh+hjs7oHEgswhU3hOEO6e7dZWTmhHH:JG5hdTyHjokAmhw6e7dZhhHH
Threatray	3'526 similar samples on MalwareBazaar
TLSH	T175D4024139A1AF6EC12D9F7958C95B308BF483116173CF0B7964BEE73AC23982A0597D
TrID	69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4505/5/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):
dhash icon	70c0d0f0c8c4f0f0 (5 x Formbook)
Reporter	cocaman
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

310

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Doc_93847332023.exe

Verdict:

Malicious activity

Analysis date:

2023-07-13 12:27:42 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5ed1c7a2-fe94-4916-abd4-aaf06c539520

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/417398/

Detection(s):

SecuriteInfo.com.Variant.Strictor.280100.11449.8787.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Restart of the analyzed sample

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/64afed5c57d1eb6a904f7406/reports/322abbd0-d09d-4945-a913-c70728d50507/overview

Verdict:

Malicious

Labled as:

Strictor.Generic

Link:

https://www.hybrid-analysis.com/sample/3d1445e540b8f4dfee869812cde4bf208bdfc2a28a510336924c860868c07c25

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c3c0790f-2a80-4b95-9044-29abee9e9d4c

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1272460

Signature

Initial sample is a PE file and has a suspicious name

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3d1445e540b8f4dfee869812cde4bf208bdfc2a28a510336924c860868c07c25/

Threat name:

Win32.Trojan.Strictor

Status:

Malicious

First seen:

2023-07-13 12:25:18 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

14 of 23 (60.87%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hukelzkaxd2n73ugtajm3zf7ecf57qvcrjiqgnusjsdaq2gapqsq._file

Verdict:

malicious

Label(s):

formbook

Formbook

2b25388d41f694e67f7a237681dffe91afa258adbec617a6c203ba6fc0f6ae88

Formbook

329650704e1626db6c03a23a11007dbb0ed82ae526d842547b2b1921ad97526a

Formbook

6948e70cac42443ee400a93e1aa7dbcc742e36eeed2e7caf2ee5ff3e19bd9ef3

Formbook

b025ef03dfe5778be2d70ac7a4ff7624bcdb5e2b11dde309f10aec9916fe0e7a

Formbook

e4b2392f7f21a26a15a063819842743f1fb6b055910cf9e1fd0e50d6187c04e7

Formbook

e58e843ff95f4ca52f2e4da56fdb3edb62fe89415d53b30c0b187f12e9e644aa

Formbook

+ 3'516 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/230713-pl6vysgf54/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Checks computer location settings

Unpacked files

SH256 hash:

7a51d5953acc46c0a0ecb416a05742d770b55fd7236fbdf733434904f33e39cc

MD5 hash:

06ddb84d215d6d372fdb3535ecb5dfac

SHA1 hash:

c965b34129632855ffa2d6b6b293bc47beae40bb

Link:

https://www.unpac.me/results/de6d6ff0-06ea-4482-8d90-f4b90701119e/

SH256 hash:

795424d02c44bb492d537f79fa572874367b2ce9208d39c07de16d3f6c7b6c7e

MD5 hash:

01dbf103215544b7d0f0df7a6c9f816e

SHA1 hash:

5cef1045d877d04254f3e94700ecceb0e24ec2e9

Link:

https://www.unpac.me/results/de6d6ff0-06ea-4482-8d90-f4b90701119e/

SH256 hash:

3d1445e540b8f4dfee869812cde4bf208bdfc2a28a510336924c860868c07c25

MD5 hash:

338a91f4a24b4856a29165df68847cde

SHA1 hash:

b9de98dd0e8f7248ab9bc62ea77886a9ba43fb43

Link:

https://www.unpac.me/results/de6d6ff0-06ea-4482-8d90-f4b90701119e/

Malware family:

XLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3d1445e540b8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.