MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3eff0b006dd228c5e1a053f73aea5ca950681ca899f4428771a94300d8844c72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 7
| SHA256 hash: | 3eff0b006dd228c5e1a053f73aea5ca950681ca899f4428771a94300d8844c72 |
|---|---|
| SHA3-384 hash: | ee8ba670b7a260f3098ef80cc67032ebd42aeecfe911a1f3cc5990ffba720bb43d8a07c00001598d3853d5507697b7c6 |
| SHA1 hash: | 45c8c8c42193e3cd24816fe7873f88db8f0d9543 |
| MD5 hash: | c7b0b5b56ebc0a5b0e84d5476644ad8b |
| humanhash: | neptune-saturn-ceiling-wolfram |
| File name: | Payment advice.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 465'408 bytes |
| First seen: | 2020-10-21 09:50:36 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 6144:I5LGM4cDvQ/ts9gCGBo2XN1gXCZjtZSSGTuMQgvqutGOKqdjWscDYnpUl4SPemu2:IwM4WQ/c2VAyMQgvquQOhBWseYSl40 |
| Threatray | 334 similar samples on MalwareBazaar |
| TLSH | BBA4CFB27C92587ECA6E0771516984C1FABA16C73FA48B0D725F830C0E11A2BFB57257 |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
abuse_ch
Malspam distributing unidentified malware:HELO: jupiter.flywan.net
Sending IP: 179.50.4.12
From: support <support@qbasica.com>
Subject: FW: Payment Advice 21.10.2020
Attachment: Payment advice.zip (contains "Payment advice.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a file in the %temp% subdirectories
Creating a window
Creating a file
Running batch commands
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
87 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Binary contains a suspicious time stamp
Creates an autostart registry key pointing to binary in C:\Windows
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Add file from suspicious location to autostart registry
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Status:
Malicious
First seen:
2020-10-21 04:14:24 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 324 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Adds Run key to start application
Loads dropped DLL
Unpacked files
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
SH256 hash:
03bd4a58606a362e687b251ef322befcc5617a43c05d67259c2fec3ddea54fc7
MD5 hash:
dfb545851f1348b8eebee3522daee85c
SHA1 hash:
1a56819e08073bd88bb4b9a50935d3bb649b6ccc
SH256 hash:
abc3472671889d7d3cf04e35f43619a90e4e480e7c759c2fb1738cbe85f8375c
MD5 hash:
c119986848427ca346e4912961efe40b
SHA1 hash:
199496ea1e0f29a04384c370d2effc30817ef1a1
SH256 hash:
efe2ab44fa0f3c98ec99e6f24008c548176beaa2bf862520979eaddec15df1fe
MD5 hash:
05cf0001e2c6641b6513544a58cf56d6
SHA1 hash:
51cd5f9e72efdb5b23bfb58e7ea1792cf04249c0
SH256 hash:
b55df4ebfc5541dd6563c67c7bd86cde5569404ccfcc27bc084eacf6981fd442
MD5 hash:
bff16fcabf604a4a0136274f2165ad93
SHA1 hash:
bf3f86133fd623c6d8082bab202ec99b5dcbf9d4
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
7dfdb884b07e676547393d16cd7d87b4b71780d62f10314755fdbd2114910ea7
MD5 hash:
d31eb49d1f88c444c1cf17cbb11dcfb7
SHA1 hash:
ee3ed99d36f823d19b4819816abfca482dba6b4d
SH256 hash:
3eff0b006dd228c5e1a053f73aea5ca950681ca899f4428771a94300d8844c72
MD5 hash:
c7b0b5b56ebc0a5b0e84d5476644ad8b
SHA1 hash:
45c8c8c42193e3cd24816fe7873f88db8f0d9543
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.