MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 442e64297fefa272744b3e6ed8cc9eb460e182d58bc256964fa73e6c3694a926. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 442e64297fefa272744b3e6ed8cc9eb460e182d58bc256964fa73e6c3694a926
SHA3-384 hash: bf3c92e734325720573667b7e889c58b0660bd8bc28bbbf5b3b29651e5fb6fa16887421bbb9a339a2074a5b9877d3215
SHA1 hash: 2f64f67824f1c2135f1edbfe5ff794176a814796
MD5 hash: ef6033995c9fd3e48357a83875a14ad2
humanhash: island-fruit-hotel-nebraska
File name:8097600987765.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:2'232'416 bytes
First seen:2024-09-10 18:29:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0191d85a19a8b2677fb8f9c2248f4479 (5 x Formbook)
ssdeep 49152:2fDe+fmH7RRZ1UW84VCyH+4FAGqnx+lg3jszx8u1rhSCgw3rQy:2fDQQsBfF1
Threatray 53 similar samples on MalwareBazaar
TLSH T1C3A5CF14E3A801A8E467D738CA659333D6B079524730E58F0A9DE6452F73E92AF7F312
TrID 47.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
35.2% (.EXE) InstallShield setup (43053/19/16)
8.6% (.EXE) Win64 Executable (generic) (10523/12/4)
4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
File icon (PE):PE icon
dhash icon e0e4a3a6a4b8b8a8 (37 x Formbook, 9 x AZORult, 9 x Loki)
Reporter TeamDreier
Tags:exe FormBook signed

Code Signing Certificate

Organisation:Microsoft Code Signing PCA 2011
Issuer:Microsoft Code Signing PCA 2011
Algorithm:sha256WithRSAEncryption
Valid from:2024-09-09T05:44:26Z
Valid to:2025-09-09T05:44:26Z
Serial number: ec245dab5a6a2ec95cbaa2d233600a11
Thumbprint Algorithm:SHA256
Thumbprint: 14653ccfe8a4e146494a3105ae1ee24b4049fd2f53f113ac157ba533390fb497
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
349
Origin country :
DK DK
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8097600987765.exe
Verdict:
Malicious activity
Analysis date:
2024-09-10 18:38:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/40d68d7d-9f07-45ed-9275-656c64d4e0a7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win64.Evo-gen.26317.21232.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66e0902f76bc4542b0495dfd
Tags:
Encryption Execution Network Static Stealth Swotter
Verdict:
Suspicious
Labled as:
Win64/GenKryptik.HAYP trojan
Link:
https://www.hybrid-analysis.com/sample/442e64297fefa272744b3e6ed8cc9eb460e182d58bc256964fa73e6c3694a926
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/95b8149f-f5ea-48de-88c4-23fd41ade09a
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1508899
Signature
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Drops PE files to the user root directory
Found direct / indirect Syscall (likely to bypass EDR)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1508899 Sample: 8097600987765.exe Startdate: 10/09/2024 Architecture: WINDOWS Score: 100 59 www.yedurrum.xyz 2->59 61 www.onemuslimmentors.xyz 2->61 63 19 other IPs or domains 2->63 79 Suricata IDS alerts for network traffic 2->79 81 Malicious sample detected (through community Yara rule) 2->81 83 Antivirus detection for URL or domain 2->83 87 7 other signatures 2->87 10 8097600987765.exe 1 3 2->10         started        14 8097600987765.exe 2 2->14         started        16 8097600987765.exe 2->16         started        18 3 other processes 2->18 signatures3 85 Performs DNS queries to domains with low reputation 61->85 process4 file5 57 C:\Users\user\8097600987765.exe, PE32+ 10->57 dropped 97 Creates autostart registry keys with suspicious names 10->97 99 Creates multiple autostart registry keys 10->99 101 Drops PE files to the user root directory 10->101 20 wab.exe 10->20         started        23 powershell.exe 23 10->23         started        25 conhost.exe 10->25         started        103 Antivirus detection for dropped file 14->103 105 Multi AV Scanner detection for dropped file 14->105 107 Writes to foreign memory regions 14->107 27 powershell.exe 23 14->27         started        29 conhost.exe 14->29         started        31 ngen.exe 14->31         started        109 Allocates memory in foreign processes 16->109 111 Adds a directory exclusion to Windows Defender 16->111 113 Injects a PE file into a foreign processes 16->113 33 powershell.exe 16->33         started        35 conhost.exe 16->35         started        37 wab.exe 16->37         started        signatures6 process7 signatures8 89 Maps a DLL or memory area into another process 20->89 39 ikAQFSYqEF.exe 20->39 injected 42 conhost.exe 23->42         started        91 Loading BitLocker PowerShell Module 27->91 44 conhost.exe 27->44         started        46 conhost.exe 33->46         started        process9 signatures10 95 Found direct / indirect Syscall (likely to bypass EDR) 39->95 48 grpconv.exe 1 13 39->48         started        process11 signatures12 71 Tries to steal Mail credentials (via file / registry access) 48->71 73 Creates multiple autostart registry keys 48->73 75 Tries to harvest and steal browser information (history, passwords, etc) 48->75 77 4 other signatures 48->77 51 ikAQFSYqEF.exe 48->51 injected 55 firefox.exe 48->55         started        process13 dnsIp14 65 synergon.space 109.95.158.127, 53472, 53473, 53474 DHOSTING-ASWarsawPolandPL Poland 51->65 67 www.zl1l5r.website 198.16.50.171, 53468, 53469, 53470 CNSERVERSUS United States 51->67 69 4 other IPs or domains 51->69 93 Found direct / indirect Syscall (likely to bypass EDR) 51->93 signatures15
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/442e64297fefa272744b3e6ed8cc9eb460e182d58bc256964fa73e6c3694a926
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/442e64297fefa272744b3e6ed8cc9eb460e182d58bc256964fa73e6c3694a926/
Threat name:
Win64.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2024-09-09 10:16:38 UTC
File Type:
PE+ (Exe)
Extracted files:
17
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iqxgikl756rhe5clhzxnrte6wrqodawvrpbfnfspu47gynuuveta._file
Verdict:
malicious
Similar samples:
3ca79e899fc4afb051d79323ae71ec356bd8a8cff6cebbfba6c8ce80f41db2a3
Formbook
521ba1cb79be977586ebc407721058753aaafd34362374c37dd23567405a4688
Formbook
7f8b4ff72b5a59f4c7bc7ce3d38bb959fe5773e98a9996b92bdc901e56a49ce3
Formbook
8d278608d1d1c4c5b6c048020c23351e75203066af1ae1e63c5c5ac0170cd3de
Formbook
e3982b1cbd3445eb68e177c578113fb2d35b4ed924fbdd7486841846c7a5beb5
Formbook
+ 43 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
credential_access discovery execution persistence stealer
Link:
https://tria.ge/reports/240910-w5f7zayanr/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Adds policy Run key to start application
Command and Scripting Interpreter: PowerShell
Credentials from Password Stores: Credentials from Web Browsers
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/61c35e8b-6124-4ed5-a3ea-d0ab5fc35ebd
Unpacked files
SH256 hash:
442e64297fefa272744b3e6ed8cc9eb460e182d58bc256964fa73e6c3694a926
MD5 hash:
ef6033995c9fd3e48357a83875a14ad2
SHA1 hash:
2f64f67824f1c2135f1edbfe5ff794176a814796
Link:
https://www.unpac.me/results/d0ed24aa-eb9c-44c4-9b3f-93ca264efc90/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/442e64297fefa272744b3e6ed8cc9eb460e182d58bc256964fa73e6c3694a926

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:Detect_APT29_WINELOADER_Backdoor
Create hunting rule
Author:daniyyell
Description:Detects APT29's WINELOADER backdoor variant used in phishing campaigns, this rule also detect bad pdf,shtml,htm and vbs or maybe more depends
Reference:https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:Jupyter_infostealer
Create hunting rule
Author:CD_R0M_
Description:Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 442e64297fefa272744b3e6ed8cc9eb460e182d58bc256964fa73e6c3694a926

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::OpenProcessToken
KERNEL32.dll::OpenProcess
KERNEL32.dll::VirtualAllocExNuma
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThreadpoolIo
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetSystemInfo
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
KERNEL32.dll::FreeConsole
KERNEL32.dll::GetConsoleWindow
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_BCRYPT_APICan Encrypt Filesbcrypt.dll::BCryptDestroyKey
bcrypt.dll::BCryptGenerateSymmetricKey
bcrypt.dll::BCryptGenRandom
bcrypt.dll::BCryptOpenAlgorithmProvider
bcrypt.dll::BCryptCloseAlgorithmProvider
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW

Comments