MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41363dd7674af776b7696e0891121ed3fd6f169a11942411869ad8aa52109c95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41363dd7674af776b7696e0891121ed3fd6f169a11942411869ad8aa52109c95
SHA3-384 hash: a70020a79cd70985746cf5f82cad9cf1a17fa7be6df8687c8c65929b431aa521748d74ae1f63d9026f87c833b2021a73
SHA1 hash: 14398d02ba121b725ce0939ce677edd884332b0a
MD5 hash: 1582657b74bb777d15dc2be696de7063
humanhash: delaware-winner-pennsylvania-charlie
File name:cbin.scr
Download: download sample
Signature Formbook
Create hunting rule
File size:729'088 bytes
First seen:2024-07-17 15:38:46 UTC
Last seen:2024-07-24 13:31:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:k4ndmoyoPPCp8+PL0/2htbQa8+xw572ApHbF1jvD/b94:xngyyQaTxw5BFJD/
TLSH T13AF4CF2837A409B4C97A8EF7FCE9416C9B30A5A26AE2D52534CB0FDC38DDB50095635F
TrID 60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.8% (.SCR) Windows screen saver (13097/50/3)
8.7% (.EXE) Win64 Executable (generic) (10523/12/4)
5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter NDA0E
Tags:exe FormBook scr


Avatar
NDA0E
https://hikplc.top/cbin.scr

Intelligence

File Origin
# of uploads :
3
# of downloads :
359
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2944.16515.17439.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6697e598936dc865ddc74fa5
Tags:
Generic Swotter
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/41363dd7674af776b7696e0891121ed3fd6f169a11942411869ad8aa52109c95
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6b45c560-0ca0-47fc-8d47-60a55966fc08
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1475195
Signature
.NET source code references suspicious native API functions
AI detected suspicious sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/41363dd7674af776b7696e0891121ed3fd6f169a11942411869ad8aa52109c95
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41363dd7674af776b7696e0891121ed3fd6f169a11942411869ad8aa52109c95/
Threat name:
ByteCode-MSIL.Backdoor.DarkComet
Create hunting rule
Status:
Malicious
First seen:
2024-07-17 15:21:59 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ie3d3v3hjl3xnn3jnyejceq62p6w6fu2cgkciemgtlmkuuqqtskq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240717-s3lswsxbrp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/82e854a4-cdd5-4f1f-a0fa-78aa0e686688
Unpacked files
SH256 hash:
c770addb1e8287f40da8362f4855cf102584af2fae443fb553f8caf2202d02ff
MD5 hash:
6eeff1735ee9b2caa71b76cd969c6f4d
SHA1 hash:
d16e87e1c2e84cf0f7f36974fa80a7211c331b75
Link:
https://www.unpac.me/results/0399d7b5-9abd-4e1b-913d-c15534a492b7/
SH256 hash:
99e58d122ee5f60b8a773dd13f26254618139f524b03d13e4a73cd194ae566ec
MD5 hash:
f1a87504843678766db5cb4c07f863fd
SHA1 hash:
c6baff564f949f750028a4bc6c82e19ea6726a0a
Link:
https://www.unpac.me/results/0399d7b5-9abd-4e1b-913d-c15534a492b7/
SH256 hash:
f95df6c931bcd1112ac759e0452303ac1f6337bdd63ef034f0a7b8b2a6651147
MD5 hash:
d99a0c531485468dc158e97b0c69faa0
SHA1 hash:
f6dfbf27b1677b0f4e4fb288e61bb822d1cb128a
Link:
https://www.unpac.me/results/0399d7b5-9abd-4e1b-913d-c15534a492b7/
SH256 hash:
45c7b64a55dca23ee1239649e03a7c361813dbcfc2a0817b0d8e94c907d6ed4b
MD5 hash:
fb1bc19121c4e190d83672bc71b493f0
SHA1 hash:
c3488b969ba578e28ee360be24b6416425a224a0
Link:
https://www.unpac.me/results/0399d7b5-9abd-4e1b-913d-c15534a492b7/
SH256 hash:
41363dd7674af776b7696e0891121ed3fd6f169a11942411869ad8aa52109c95
MD5 hash:
1582657b74bb777d15dc2be696de7063
SHA1 hash:
14398d02ba121b725ce0939ce677edd884332b0a
Link:
https://www.unpac.me/results/0399d7b5-9abd-4e1b-913d-c15534a492b7/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/41363dd7674a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41363dd7674af776b7696e0891121ed3fd6f169a11942411869ad8aa52109c95

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Rich Text Format (RTF) rtf 35aa094ef5e31708b49d5128ab5a7c05bdc71af43dd605f9140d71c396528929

Formbook

Executable exe 41363dd7674af776b7696e0891121ed3fd6f169a11942411869ad8aa52109c95

(this sample)

  
Dropped by
SHA256 35aa094ef5e31708b49d5128ab5a7c05bdc71af43dd605f9140d71c396528929
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3048421/
  
URLhaus
https://urlhaus.abuse.ch/url/3048426/
  
Dropped by
MD5 e04274edaef1c789f6748fd0b16b1d44

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments