MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40af7ea5c438a5e5d39e726925d6ce11eadb0438f7dcaa50e753e7bb393f6775. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40af7ea5c438a5e5d39e726925d6ce11eadb0438f7dcaa50e753e7bb393f6775
SHA3-384 hash: 2b028bc6886163c8e05356a375043f0ebb2c6f04cbe5a7f7bbc67caa9fed2ef514a5461eb9204a91fb8d5141e1806feb
SHA1 hash: f1266cbb9908d2121f06845e764e4a249f5e3fce
MD5 hash: 861632d63af8b5cc4a72b7fc09aef813
humanhash: mexico-lion-tennis-yankee
File name:PL59107-00.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:331'069 bytes
First seen:2023-05-04 17:48:16 UTC
Last seen:2023-05-13 22:55:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e160ef8e55bb9d162da4e266afd9eef3 (140 x GuLoader, 33 x RemcosRAT, 17 x AgentTesla)
ssdeep 6144:R4SUjhth5tWIzlI2nUWnKdn6zqouoAbdZmLm56zsoI+vL9sEInDpx:q/oalIyUJhaqfPbDmLG6g+S/9x
Threatray 1'637 similar samples on MalwareBazaar
TLSH T1DB6412533B89C89FD4580A7E8C379BFD07F37D0DA6241A0747A47F6A34312829F6A586
TrID 92.7% (.EXE) NSIS - Nullsoft Scriptable Install System (846567/2/133)
3.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
1.1% (.EXE) Win64 Executable (generic) (10523/12/4)
0.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
0.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 9b03f098ec7000a8 (6 x GuLoader, 2 x AZORult, 1 x Formbook)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
247
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PL59107-00.exe
Verdict:
Malicious activity
Analysis date:
2023-05-04 17:53:37 UTC
Tags:
installer
Link:
https://app.any.run/tasks/3b85a052-f8d9-483d-ba81-3d8bd145f03a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/386589/
Detection(s):
SecuriteInfo.com.Gen.Variant.Nemesis.22798.15513.5596.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file
Delayed reading of the file
Creating a file in the %temp% subdirectories
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6453f00e961a21dc785cda1c/reports/41932f41-c936-451c-8867-e809321326f4/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/40af7ea5c438a5e5d39e726925d6ce11eadb0438f7dcaa50e753e7bb393f6775
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6f031e16-a79a-4e5a-81bf-2f6fbe179041
Result
Threat name:
GuLoader, FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1226414
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Hides threads from debuggers
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected FormBook
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 859377 Sample: PL59107-00.exe Startdate: 04/05/2023 Architecture: WINDOWS Score: 100 35 www.qy-zh.net 2->35 37 www.pipeops.app 2->37 39 30 other IPs or domains 2->39 49 Snort IDS alert for network traffic 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 6 other signatures 2->55 11 PL59107-00.exe 1 42 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\Local\...\System.dll, PE32 11->29 dropped 31 C:\Users\user\AppData\Local\...\msader15.dll, PE32+ 11->31 dropped 33 C:\Users\user\AppData\Local\...\lang-1037.dll, PE32 11->33 dropped 14 PL59107-00.exe 6 11->14         started        process6 dnsIp7 47 globosphera.org 92.222.244.238, 49858, 80 OVHFR France 14->47 63 Modifies the context of a thread in another process (thread injection) 14->63 65 Tries to detect Any.run 14->65 67 Maps a DLL or memory area into another process 14->67 69 3 other signatures 14->69 18 explorer.exe 4 1 14->18 injected signatures8 process9 dnsIp10 41 fukuoka-h.com 113.43.208.223, 49877, 80 UCOMARTERIANetworksCorporationJP Japan 18->41 43 celarush.com 103.72.76.90, 49863, 80 TOMATOWEB-BDTomatoWebPvtLimitedBD Bangladesh 18->43 45 13 other IPs or domains 18->45 57 System process connects to network (likely due to code injection or exploit) 18->57 22 systray.exe 18->22         started        signatures11 process12 signatures13 59 Modifies the context of a thread in another process (thread injection) 22->59 61 Maps a DLL or memory area into another process 22->61 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/40af7ea5c438a5e5d39e726925d6ce11eadb0438f7dcaa50e753e7bb393f6775/
Threat name:
Win32.Trojan.Convagent
Create hunting rule
Status:
Malicious
First seen:
2023-05-04 14:46:47 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
18 of 35 (51.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=icxx5joehcs6lu46ojuslvwochvnwbby67okuuhhkpt3woj7m52q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
169fdf358714cd65c4451fe9ec9cb72217367296298f5b570b3e6c74f1a59f61
Formbook
4cdfd3ac195a3194d4a4ad72a3d3aeab0009f8b8bcdd73f7664ebeafd0023bae
Formbook
51054c5181fc248a1642dc3a5cdb7f353aaf5d136aa20bdc59084970e74c5a8b
Formbook
56462c46e025fb1ddfe7793825dbde4130e9db4052b271f21b60069efeba96f6
Formbook
6e8de74475e365bdd0f573a03266f447a13f30a76cc2c71d14c1fc5607e1ae5d
Formbook
c05150aeb82312c064d530c0570a19436d44bb0955142074a4787aa998677d6d
Formbook
c3c4281831f463d7ee622d35ea584b893b99400c0dc7dda327557d48f10ec564
Formbook
e4e2091a348b6f883c60951545d1318dae365658c50f7a5d342144f42aa224d6
Formbook
ec7b126f18f83e30e62048a83f8867ecccec8aa89c4020686044bb229faffb8b
Formbook
eea29ccf59fa6a6aa5a3c14360db6068144f14601d987ec37ea21a35cdac9430
Formbook
+ 1'627 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:bb27 rat spyware stealer trojan
Link:
https://tria.ge/reports/230504-wdzv1aga51/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent file
Loads dropped DLL
Formbook payload
Formbook
Unpacked files
SH256 hash:
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
MD5 hash:
a436db0c473a087eb61ff5c53c34ba27
SHA1 hash:
65ea67e424e75f5065132b539c8b2eda88aa0506
Link:
https://www.unpac.me/results/1e4798e4-a714-40da-a6de-7b4e7d2c76e5/
SH256 hash:
40af7ea5c438a5e5d39e726925d6ce11eadb0438f7dcaa50e753e7bb393f6775
MD5 hash:
861632d63af8b5cc4a72b7fc09aef813
SHA1 hash:
f1266cbb9908d2121f06845e764e4a249f5e3fce
Link:
https://www.unpac.me/results/1e4798e4-a714-40da-a6de-7b4e7d2c76e5/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/40af7ea5c438/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/40af7ea5c438a5e5d39e726925d6ce11eadb0438f7dcaa50e753e7bb393f6775

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/386589/

Comments