MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 456571cb765187fa0c2e5d5e95545614a3f41f82f502fde9a386b7cb8f7190c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 12
| SHA256 hash: | 456571cb765187fa0c2e5d5e95545614a3f41f82f502fde9a386b7cb8f7190c7 |
|---|---|
| SHA3-384 hash: | f6ccbbe31b260d2ccd2cd941a85e44e7d4a0c37132451e461738520af02852a7ca61e1c263404f6a4e6c5240be09c219 |
| SHA1 hash: | 765352a941e24a7c26189a0a1a00de9a31691c3d |
| MD5 hash: | 95d34a03d24ab8e90867ec8b227318bf |
| humanhash: | saturn-ohio-cold-virginia |
| File name: | DHL_April 2023 at 1.10_8BZ290_PDF.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 878'592 bytes |
| First seen: | 2023-04-09 07:04:44 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger) |
| ssdeep | 24576:wKEGQuQ3LLRRScyKYbu/UeqPvbxb804aemnase4FvbHFMRRQCRabR1RMFugpUpp7:q3nicyKYMUe3ynLeevbHFMRRQCRabR1n |
| Threatray | 2'630 similar samples on MalwareBazaar |
| TLSH | T102153A9A06B2039BD57809B05B68BED01574EFB5BB1083297C41FCAF9DF27D650623E2 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | c4bada9ae8cca4c8 (13 x Formbook, 6 x AgentTesla, 5 x AveMariaRAT) |
| Reporter |  abuse_ch |
| Tags: | DHL exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
244
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL_April 2023 at 1.10_8BZ290_PDF.exe
Verdict:
Malicious activity
Analysis date:
2023-04-09 07:07:03 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
formbook packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Signature
.NET source code contains potential unpacker
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-04-09 07:05:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
22
AV detection:
19 of 37 (51.35%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'620 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Gathers network information
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Unpacked files
SH256 hash:
e8476bc995b2001e405ed17239bc17dc48913a9b8861b5b9af87049bbfa147d6
MD5 hash:
643d9767eb6f487cab35b7a75873c732
SHA1 hash:
12bca33ec2a8c44fb553ce9efd16d5886a0e3f99
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
cc0bafceacdf7a7c2890340518ed00b3b44206b9bac9c02db260e9500bef6b4c
MD5 hash:
cbfe5c9ffe2dd8364291be9eab18488f
SHA1 hash:
ab2f0ea95ae97e66716bb76d5a3674fe16e7c675
SH256 hash:
468cf122915f4200cdde306d6e8bcd37d06e784d4f910d24cf3b4f4d1dc9f814
MD5 hash:
e0257ad7ca48054f46ca143471758ecb
SHA1 hash:
d2d07dd95c106893f69f8ff342a62473013ddc21
SH256 hash:
6ed5754774ca845ea9082b30abb01d1db00078035c800d347212d21778ae5b72
MD5 hash:
656856ebecb29670e0e8fa56046e5eb4
SHA1 hash:
954b5a1bca5190305e1245b041dddcd487e28924
SH256 hash:
5ce8eaf88ddde087d71e22ca4254e9baabb558cb9545ef5909151553f0d17536
MD5 hash:
fe67ea33a3ae8164164c45634eee78b9
SHA1 hash:
8d3bbf29680ece649543c35c69a944c4ada66940
SH256 hash:
3c507afadbb1c31a9ebdd24baac5739d47576159e01c5e84f973c951885100aa
MD5 hash:
e79bf0e7e9d52d398e0b23b352394c68
SHA1 hash:
682325763a0ec77e0fd475ea3a4021b4651eceac
SH256 hash:
456571cb765187fa0c2e5d5e95545614a3f41f82f502fde9a386b7cb8f7190c7
MD5 hash:
95d34a03d24ab8e90867ec8b227318bf
SHA1 hash:
765352a941e24a7c26189a0a1a00de9a31691c3d
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.