MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4cd63f444a094e29ccbf750edf7ae60a7fae0691aac149e61563d1da1fbf4ff8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4cd63f444a094e29ccbf750edf7ae60a7fae0691aac149e61563d1da1fbf4ff8
SHA3-384 hash: 13de22b7734197ae5f876c6ee9208bb9a7a78ded0ed1ab195c8f4dee7b3a9b6586ece335c5885aa00e43d1055743bb70
SHA1 hash: d9f9625bc1b5357d4ec58d154cc46e46bef23866
MD5 hash: 193c21232bcb00338b6e1b3a13511381
humanhash: sierra-failed-mango-jig
File name:PO_111101011.hta
Download: download sample
Signature Formbook
Create hunting rule
File size:550'514 bytes
First seen:2024-12-03 10:19:37 UTC
Last seen:Never
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 12288:cQFEmx03Xdq/Z7zSlTllfrB/g+RSSk4eQ8r75J:cQFEm0SSllfrHR64eQ8n3
TLSH T171C41201E32B8BB50E4B2E6D19411BE2DB8D8CEB9D5ECB87F14C051A53F56FB5026E44
Magika vba
Reporter lowmal3
Tags:FormBook hta

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.VBS.Agent.BMY.tr.24380.10858.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=674edd18e64d1c722d7bb4ec
Tags:
spawn micro
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/4cd63f444a094e29ccbf750edf7ae60a7fae0691aac149e61563d1da1fbf4ff8/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/674edb537bae4cb482ffdfc6/reports/93855914-ebd3-4797-98e5-83873ffd5dc9/overview
Verdict:
Suspicious
Labled as:
VBS/TrojanDropper.Agent
Link:
https://www.hybrid-analysis.com/sample/4cd63f444a094e29ccbf750edf7ae60a7fae0691aac149e61563d1da1fbf4ff8
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1567277
Signature
.NET source code contains potential unpacker
AI detected suspicious sample
Allocates memory in foreign processes
Antivirus detection for dropped file
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Sigma detected: Legitimate Application Dropped Executable
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4cd63f444a094e29ccbf750edf7ae60a7fae0691aac149e61563d1da1fbf4ff8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4cd63f444a094e29ccbf750edf7ae60a7fae0691aac149e61563d1da1fbf4ff8/
Threat name:
Document-HTML.Backdoor.FormBook
Create hunting rule
Status:
Suspicious
First seen:
2024-12-03 10:20:05 UTC
File Type:
Text (HTML)
Extracted files:
1
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jtld6rckbfhcttf7ouhn66xgbj724burvlautzqvmpi5uh57j74a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
error
Formbook
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/241203-mc3qtswpeq/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4cd63f444a094e29ccbf750edf7ae60a7fae0691aac149e61563d1da1fbf4ff8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

HTML Application (hta) hta 4cd63f444a094e29ccbf750edf7ae60a7fae0691aac149e61563d1da1fbf4ff8

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments