🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 435bf6fa934925c64ce22f7bd35e590a3bcd2e94fe5fc0a533d8786a7bca8d86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Maldoc score: 4


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 435bf6fa934925c64ce22f7bd35e590a3bcd2e94fe5fc0a533d8786a7bca8d86
SHA3-384 hash: 1008336a480224f46662915e3593008e07f99ebe40c2a0d84131464febf39b996a01fb04cc8eaf1230392bd0c2a8a7bd
SHA1 hash: 6923d31b186b810feaecc442a939dbe1dd885ed7
MD5 hash: 8a0c0e891760b1f8d30987e48164d400
humanhash: crazy-ceiling-mexico-fifteen
File name:Thermo Fisher RFQ_TFS-1702.xls
Download: download sample
Signature Formbook
Create hunting rule
File size:867'840 bytes
First seen:2024-10-16 06:28:31 UTC
Last seen:2024-10-16 07:58:24 UTC
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 12288:3mzHJE+Czld4D3DERnLRmF8DBJhuiq3LmF1idHb3Lilu1DTKe4QYU:eczlebARM8VTq3qTulTH4L
TLSH T109059DD3AA1E4F25CD850274A6F3476A1B24DC83C526472B12F473687AFBAC43946F8D
TrID 46.5% (.XLS) Microsoft Excel sheet (alternate) (56500/1/4)
26.7% (.XLS) Microsoft Excel sheet (32500/1/3)
20.1% (.XLS) Microsoft Excel sheet (alternate) (24500/1/2)
6.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika xls
Reporter abuse_ch
Tags:cve-2017-0199 FormBook xls

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 4
OLE dump

MalwareBazaar was able to identify 28 sections in this file using oledump:

Section IDSection sizeSection name
1114 bytesCompObj
2244 bytesDocumentSummaryInformation
3200 bytesSummaryInformation
4114 bytesMBD002FB8D1/CompObj
5244 bytesMBD002FB8D1/DocumentSummaryInformation
690976 bytesMBD002FB8D1/SummaryInformation
720 bytesMBD002FB8D1/MBD0018D4CE/Ole
84 bytesMBD002FB8D1/MBD0018D4CE/ObjInfo
9197671 bytesMBD002FB8D1/MBD0018D4CE/Contents
10114 bytesMBD002FB8D1/MBD00253C98/CompObj
1118455 bytesMBD002FB8D1/MBD00253C98/Package
12114 bytesMBD002FB8D1/MBD00254B5A/CompObj
1322238 bytesMBD002FB8D1/MBD00254B5A/Package
14114 bytesMBD002FB8D1/MBD0025715C/CompObj
15484 bytesMBD002FB8D1/MBD0025715C/DocumentSummaryInformation
1619956 bytesMBD002FB8D1/MBD0025715C/SummaryInformation
1795624 bytesMBD002FB8D1/MBD0025715C/Workbook
18170317 bytesMBD002FB8D1/Workbook
19544 bytesMBD002FB8D2/Ole
20226248 bytesWorkbook
21525 bytes_VBA_PROJECT_CUR/PROJECT
22104 bytes_VBA_PROJECT_CUR/PROJECTwm
23977 bytes_VBA_PROJECT_CUR/VBA/Sheet1
24977 bytes_VBA_PROJECT_CUR/VBA/Sheet2
25977 bytes_VBA_PROJECT_CUR/VBA/Sheet3
26985 bytes_VBA_PROJECT_CUR/VBA/ThisWorkbook
272644 bytes_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
28553 bytes_VBA_PROJECT_CUR/VBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
2
# of downloads :
410
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8a0c0e891760b1f8d30987e48164d400.xls
Verdict:
No threats detected
Analysis date:
2024-10-16 05:32:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c0563825-1ea3-4178-8e2a-5f56d9c6f30f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
TwinWave.EvilDoc.93TilInfinity.20240412.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=670f5d331d4ef219fa633bd0
Tags:
Powershell Downloader Exploit Trojan
Result
Verdict:
Malicious
File Type:
Legacy Excel File with Macro
Link:
https://app.docguard.net/435bf6fa934925c64ce22f7bd35e590a3bcd2e94fe5fc0a533d8786a7bca8d86/results/dashboard
Payload URLs
URL
File name
https://jfm.com.co/TkZ?&downgrade=sour&sill=alcoholic&margaret=melted&shampoo=gigantic&behavior=high-pitched&friction
Embedded Ole
Behaviour
SuspiciousRTF detected
Document image
Image:
Download PNG
Document image
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
macros
Link:
https://www.filescan.io/uploads/670f5d301bf94173fc6ff6ce/reports/a9c5dc4c-2a6a-4b2f-9c4d-0a814de56006/overview
Verdict:
Malicious
Labled as:
CVE-2017-0199
Link:
https://www.hybrid-analysis.com/sample/435bf6fa934925c64ce22f7bd35e590a3bcd2e94fe5fc0a533d8786a7bca8d86
Label:
Benign
Suspicious Score:
2.2/10
Score Malicious:
23%
Score Benign:
77%
Link:
https://www.malware.ai/gui/files/?id=298c5409-88a6-409f-84d9-b627d13d0d09
Result
Threat name:
FormBook, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1534806
Signature
Document exploit detected (process start blacklist hit)
Early bird code injection technique detected
Excel sheet contains many unusual embedded objects
Found direct / indirect Syscall (likely to bypass EDR)
Installs new ROOT certificates
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Microsoft Office drops suspicious files
Performs DNS queries to domains with low reputation
PowerShell case anomaly found
Powershell drops PE file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious PowerShell Parameter Substring
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Yara detected FormBook
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1534806 Sample: Thermo Fisher RFQ_TFS-1702.xls Startdate: 16/10/2024 Architecture: WINDOWS Score: 100 88 www.030003378.xyz 2->88 90 030003378.xyz 2->90 92 www.sqlite.org 2->92 116 Suricata IDS alerts for network traffic 2->116 118 Malicious sample detected (through community Yara rule) 2->118 120 Yara detected FormBook 2->120 124 10 other signatures 2->124 14 EXCEL.EXE 59 33 2->14         started        signatures3 122 Performs DNS queries to domains with low reputation 88->122 process4 dnsIp5 104 192.3.101.145, 49166, 49168, 49169 AS-COLOCROSSINGUS United States 14->104 106 jfm.com.co 150.136.81.248, 443, 49165, 49167 ORACLE-BMC-31898US United States 14->106 78 C:\...\Thermo Fisher RFQ_TFS-1702.xls (copy), Composite 14->78 dropped 80 C:\Users\...\enconomicreasearchgood[1].hta, HTML 14->80 dropped 108 Microsoft Office drops suspicious files 14->108 19 mshta.exe 10 14->19         started        23 mshta.exe 14->23         started        file6 signatures7 process8 dnsIp9 94 jfm.com.co 19->94 128 Suspicious powershell command line found 19->128 130 PowerShell case anomaly found 19->130 25 powershell.exe 24 19->25         started        96 jfm.com.co 23->96 29 powershell.exe 23->29         started        signatures10 process11 file12 70 C:\Users\user\AppData\Roaming\taskhostw.exe, PE32 25->70 dropped 72 C:\Users\user\AppData\...\taskhostsw[1].exe, PE32 25->72 dropped 74 C:\Users\user\AppData\...\yvqpbsox.cmdline, Unicode 25->74 dropped 136 Powershell drops PE file 25->136 31 taskhostw.exe 17 25->31         started        35 powershell.exe 4 25->35         started        37 csc.exe 2 25->37         started        39 taskhostw.exe 29->39         started        41 csc.exe 29->41         started        43 powershell.exe 29->43         started        signatures13 process14 file15 82 C:\Users\user\AppData\Roaming\...\orgeats.Kve, ASCII 31->82 dropped 110 Suspicious powershell command line found 31->110 45 powershell.exe 3 31->45         started        112 Installs new ROOT certificates 35->112 84 C:\Users\user\AppData\Local\...\yvqpbsox.dll, PE32 37->84 dropped 49 cvtres.exe 37->49         started        51 powershell.exe 39->51         started        86 C:\Users\user\AppData\Local\...\ttz5riko.dll, PE32 41->86 dropped 53 cvtres.exe 41->53         started        signatures16 process17 file18 76 C:\Users\user\AppData\Local\...behaviorgraphunhild26.exe, PE32 45->76 dropped 142 Early bird code injection technique detected 45->142 144 Writes to foreign memory regions 45->144 146 Sample uses process hollowing technique 45->146 148 2 other signatures 45->148 55 Gunhild26.exe 45->55         started        59 Gunhild26.exe 51->59         started        signatures19 process20 dnsIp21 98 www.bookinginfo.asia 55->98 100 bookinginfo.asia 199.217.106.226, 443, 49175, 49176 AXCELX-NETUS United States 55->100 132 Maps a DLL or memory area into another process 55->132 134 Switches to a custom stack to bypass stack traces 55->134 61 wJfeiVrAhk.exe 55->61 injected 102 www.bookinginfo.asia 59->102 signatures22 process23 signatures24 138 Maps a DLL or memory area into another process 61->138 140 Found direct / indirect Syscall (likely to bypass EDR) 61->140 64 choice.exe 61->64         started        process25 signatures26 114 Maps a DLL or memory area into another process 64->114 67 wJfeiVrAhk.exe 64->67 injected process27 signatures28 126 Found direct / indirect Syscall (likely to bypass EDR) 67->126
Score:
100%
Verdict:
Malware
File Type:
OFFICE
Link:
https://malprob.io/report/435bf6fa934925c64ce22f7bd35e590a3bcd2e94fe5fc0a533d8786a7bca8d86
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/435bf6fa934925c64ce22f7bd35e590a3bcd2e94fe5fc0a533d8786a7bca8d86/
Threat name:
Document-Office.Exploit.CVE-2017-0199
Create hunting rule
Status:
Malicious
First seen:
2024-10-16 03:52:48 UTC
File Type:
Document
Extracted files:
66
AV detection:
12 of 37 (32.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=inn7n6utjes4mthcf555gxszbi542luu7zp4bjjt3b4gu66krwda._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery
Link:
https://tria.ge/reports/241016-g8xxka1fqq/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
System Location Discovery: System Language Discovery
Process spawned unexpected child process
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/19b4eb22-a0f3-45ee-9e2d-9170ae9eece5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/435bf6fa934925c64ce22f7bd35e590a3bcd2e94fe5fc0a533d8786a7bca8d86

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments