MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42446279d5d4fb0d3648e43654ed0442b5b17b6ea59833845adc901030b79aa5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	42446279d5d4fb0d3648e43654ed0442b5b17b6ea59833845adc901030b79aa5
SHA3-384 hash:	533359a935c0032da5c765250e5d4b144026ba0057397091b7345fd21cce012d72225b4d16aaa5484ec9f0055fb02a73
SHA1 hash:	d33c3cb454d6484a04184ee3260fafcbf057e130
MD5 hash:	c8228d7231c79c4dfcd447a8056b0cde
humanhash:	vegan-georgia-nine-sad
File name:	HBL+MBL shipping advice.zip
Download:	download sample
Signature	Formbook Create hunting rule
File size:	718'931 bytes
First seen:	2023-01-06 10:34:38 UTC
Last seen:	2023-01-06 10:51:54 UTC
File type:	zip
MIME type:	application/zip
ssdeep	12288:yxAFwv1bXcq88RMmOyoaOiiWJqhhCsOtqCENqhApHgU+x+b7s53/4DjiCQnBmKj:QpspidikcCsOkDV8/lCQnx
TLSH	T135E4335029BD976981AC48716FA7578AE30FA254752F609703533812BCD3FC88E275BF
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	FormBook Shipping zip

cocaman

Malicious email (T1566.001)
From: "bianca@wincologistics.com<bianca@wincologistics.com>" (likely spoofed)
Received: "from wincologistics.com (unknown [202.55.135.199]) "
Date: "5 Jan 2023 23:26:29 -0800"
Subject: "=?UTF-8?B?UFJFLUFMRVJUICBTTyNTSEFDQjIyMDQ2NzQ3ICBKT0IjU1pZQzIyMTIyMjgx77yaU2hhbmdoYWkgdG8gQ2hlbm5haSAvLyAxKjQwSFEgLy8gQk9FIHRvIERpeG9u?="
Attachment: "HBL+MBL shipping advice.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	HBL+MBL shipping advice.exe
File size:	1'418'752 bytes
SHA256 hash:	67388fca813133367167001c4114d6cd97b4bed24d0acdfda8b5784723a698ea
MD5 hash:	470c86b09a464fbc811c22ca4c135f91
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Variant.Tedy.269903.11547.7853.UNOFFICIAL

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/42446279d5d4fb0d3648e43654ed0442b5b17b6ea59833845adc901030b79aa5/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

msiexec.exe packed

Link:

https://www.filescan.io/uploads/63b7f95706f34cc0fa52b29b/reports/8aaa1ece-f749-4c64-9842-7ffeeed96b0e/overview

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/42446279d5d4fb0d3648e43654ed0442b5b17b6ea59833845adc901030b79aa5

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/42446279d5d4fb0d3648e43654ed0442b5b17b6ea59833845adc901030b79aa5/

Threat name:

ByteCode-MSIL.Trojan.FormBook

Status:

Malicious

First seen:

2023-01-05 10:50:01 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

19 of 26 (73.08%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ijcge6ov2t5q2nsi4q3fj3ieik23c63ouwmdhbc23sibamfxtksq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/230106-mnt8tsbd7s/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Loads dropped DLL

Reads user/profile data of web browsers

Uses the VBS compiler for execution

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/42446279d5d4fb0d3648e43654ed0442b5b17b6ea59833845adc901030b79aa5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.