MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41a6b66b34474558a055b445266241047c38240b85fbf399be40e8841f742d83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41a6b66b34474558a055b445266241047c38240b85fbf399be40e8841f742d83
SHA3-384 hash: bf26003bf3dc250e5f11576bc76085d728a4ec99485efd5476871bbc18df56da7b69217555812e6ccc8ec2e5bfffc490
SHA1 hash: a840c66ccd1761f431e95b40e8dc4daf2551afcc
MD5 hash: 4804d6ffce0d37864ab01b3e10f63bf9
humanhash: glucose-angel-magazine-grey
File name:SecuriteInfo.com.Win32.TrojanX-gen.196.15950
Download: download sample
Signature Formbook
Create hunting rule
File size:14'848 bytes
First seen:2023-07-26 02:27:51 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 6b2143eb6bf3b6b18e23ff7de66e6891 (3 x Formbook)
ssdeep 192:0wsvVONtmUuAX1+ixmlhHppMIP3RmUPM4Llrh5eb4QIxoV+3EbSixBngUB:05syElLIhdP3RmUBNib4QI6xBgG
Threatray 2'307 similar samples on MalwareBazaar
TLSH T145628D728F438479CEEE2EB849E70D6F5915A514220D11B08F2A0F9DACA6B97FB431C5
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter SecuriteInfoCom
Tags:dll FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
263
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/433323/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.196.15950.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware lolbin packed setupapi
Link:
https://www.filescan.io/uploads/64c084b4c9eaf6e23b9b907b/reports/f94f0853-8b69-4c49-afcc-4afd3730a7e4/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/41a6b66b34474558a055b445266241047c38240b85fbf399be40e8841f742d83
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5a05b24c-56a8-4d05-9f2d-f7d5012c0433
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1279785
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1279785 Sample: SecuriteInfo.com.Win32.Troj... Startdate: 26/07/2023 Architecture: WINDOWS Score: 52 36 Multi AV Scanner detection for submitted file 2->36 38 Machine Learning detection for sample 2->38 8 loaddll32.exe 1 2->8         started        10 xhdmirbwgpktpy.exe 2->10         started        12 xhdmirbwgpktpy.exe 2->12         started        process3 process4 14 cmd.exe 1 8->14         started        16 rundll32.exe 1 2 8->16         started        19 rundll32.exe 8->19         started        21 5 other processes 8->21 file5 23 rundll32.exe 14->23         started        32 C:\Users\user\AppData\...\xhdmirbwgpktpy.exe, PE32 16->32 dropped 25 WerFault.exe 9 16->25         started        27 WerFault.exe 9 19->27         started        process6 process7 29 WerFault.exe 24 10 23->29         started        dnsIp8 34 192.168.2.1 unknown unknown 29->34
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41a6b66b34474558a055b445266241047c38240b85fbf399be40e8841f742d83/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-07-26 01:29:55 UTC
File Type:
PE (Dll)
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=igtlm2zui5cvricvwrcsmysbar6dqjalqx57hgn6iduiih3ufwbq._file
Verdict:
unknown
Similar samples:
1c4ac768f9aa607d3a57dad6eb1313409f190fb0275ee624daf235e949f4cc40
Formbook
37f3dc0db96f235594f3e2153e851add6103e86a79b81722a130c592d1981f0a
Formbook
38dc7554359b82417ee81851f0bd42f9661cd4d4b70a648ae8a8cdf1e0b50b37
Formbook
4f46b17d1db8bdb30b33dfa8ed5335149bb4f920780e349b6b02155e337c8b57
Formbook
8eb2f7ab9bab3a18b8e697ade5fa57a70f7200bb442179bb8761b9f2d876345f
Formbook
9e7731d5cbdd2e9f9c3add54e43eda6a82d782288bf5e9f5a9388affb772e3e3
Formbook
da9c5f609ebbcf19aef3d6992d451ccbe4fa77858660f6861146d1a486e1d98e
Formbook
ebb0272ecef9d8bf07a71b9ead8718760d27c4fdc334fe2de7a8b93237e61044
Formbook
f4ae92de4d8c8717317c6575c5e519e0dd9f2002bc9a3eb2b8435c429eef04d6
Formbook
f7537939cb6791cf3b5919514a93bab3a03c8b1d4291817206543902ee63f81a
Formbook
+ 2'297 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/230726-cx1f4ahd91/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Unpacked files
SH256 hash:
41a6b66b34474558a055b445266241047c38240b85fbf399be40e8841f742d83
MD5 hash:
4804d6ffce0d37864ab01b3e10f63bf9
SHA1 hash:
a840c66ccd1761f431e95b40e8dc4daf2551afcc
Link:
https://www.unpac.me/results/5a2105fb-5b53-4255-899a-6d6d8197e5f1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41a6b66b34474558a055b445266241047c38240b85fbf399be40e8841f742d83

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/433323/

Comments