MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 400cf8fe4f1f1d748f7e6696227fe25164aa51e2c731e5cc621d708d0015065b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | 400cf8fe4f1f1d748f7e6696227fe25164aa51e2c731e5cc621d708d0015065b |
|---|---|
| SHA3-384 hash: | ff91bcea6307e69565cb57de37d19a5d495279643a3636f9d6fff2d91cde7f541d1411d49e5527f061616eb875c79d1b |
| SHA1 hash: | 0bc9f1238c5560286a7a0273497bee2e19b73d81 |
| MD5 hash: | 0fa72e0e60187e79ab720cf120edab4f |
| humanhash: | kitten-violet-ohio-skylark |
| File name: | 0fa72e0e60187e79ab720cf120edab4f |
| Download: | download sample |
| Signature | Formbook |
| File size: | 585'216 bytes |
| First seen: | 2022-06-23 19:48:38 UTC |
| Last seen: | 2022-06-23 20:36:04 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 12288:99AwgpvdeSJ9fQMvThWbevzZwfQ2Zt1WOULacUApU2M0jK:Tg/9nvThTdw4Et1FUU |
| TLSH | T105C4E18C3790B19FC9ABCE72DA581D24AA30B9B7870BD3477453229C991E65ACF015F3 |
| TrID | 61.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.0% (.SCR) Windows screen saver (13101/52/3) 8.8% (.EXE) Win64 Executable (generic) (10523/12/4) 5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
fareit formbook packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Detection:
xloader
Threat name:
Win32.Trojan.GenericML
Status:
Malicious
First seen:
2022-06-23 19:46:23 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
15 of 40 (37.50%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Result
Malware family:
xloader
Score:
10/10
Tags:
family:xloader campaign:nekq loader rat
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Unpacked files
SH256 hash:
ce36bd9195e8c900d874977fbb662fec5f13a70981e40ab4a6a5d2016f2fb73b
MD5 hash:
76ae01da64c6f011d617ad1d49935cd3
SHA1 hash:
328ec59a3a44c6c10fcb150fab8724022eee59a5
Detections:
win_formbook_g0
win_formbook_auto
XLoader
SH256 hash:
3e42bb94afbf15b70153e7a8c008f675c276f2bcfedaab78382220f0bef65dfe
MD5 hash:
31b4c47d34b953509805d3f9f94297c4
SHA1 hash:
8b1cd28506f881d7a398cc5c95cb22c37fda2177
SH256 hash:
8b17d5f3cd83a5b17e01c052b973d19bb0359ca004fd04ed9bb9a430243eb097
MD5 hash:
7ba3fcfa29a8250b7446bee5177b9a33
SHA1 hash:
1233f826b0c895df43e65bb0551d8f0a652dd04b
SH256 hash:
f83ad4fc8d9bc52e97c1bd43724f56b06a3ecea2d162a633a1d484f0b99eca49
MD5 hash:
8a9b8ea72b8cefb4eebb1d1fe8e4fc57
SHA1 hash:
009b81de36459eab866309484e092d4708d20c82
SH256 hash:
400cf8fe4f1f1d748f7e6696227fe25164aa51e2c731e5cc621d708d0015065b
MD5 hash:
0fa72e0e60187e79ab720cf120edab4f
SHA1 hash:
0bc9f1238c5560286a7a0273497bee2e19b73d81
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxps://dynamiperkasa.com/e1/3h.exe