MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4dc1d7f5403f147bc8bd69fe671d86c1a990ed0c3727d07b757ef95fbcd232b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4dc1d7f5403f147bc8bd69fe671d86c1a990ed0c3727d07b757ef95fbcd232b9
SHA3-384 hash: cf4c3fc82775af43c3ecfe7cf14a43b434f97bc9bb1aeb89a46c6f5af7a588ef7a823c963727c4f63e13dfc1c450937e
SHA1 hash: 6d0d79d464dac3a5ee563f5afabae73b0317fe20
MD5 hash: 77cdc00597ec524e4d445a274a55a053
humanhash: sad-three-india-fix
File name:HSBC Payment Advice_pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:389'281 bytes
First seen:2023-03-13 09:32:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep 6144:sYa6sMA6sjf9FmJT0NBu8FpCUmAUwL1/ghd9AoFGBZZdwEhT:sYCnHjf9FA0zzFpRNgBAOGDZWEd
Threatray 2'367 similar samples on MalwareBazaar
TLSH T16084E0B07B9CB132DAE17A314CF566D725D6AC651A34C70E16C0BE073B726B2C90BA1D
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f06996d6cad20d52 (3 x RemcosRAT, 3 x Formbook)
Reporter abuse_ch
Tags:exe FormBook HSBC

Intelligence

File Origin
# of uploads :
1
# of downloads :
207
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
HSBC Payment Advice_pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-03-13 09:36:24 UTC
Tags:
stealer formbook trojan
Link:
https://app.any.run/tasks/78830471-7c28-4add-9787-383e5694a6f8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/373940/
Detection(s):
Sanesecurity.Malware.28885.BadCo.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Launching a process
DNS request
Sending an HTTP GET request
Reading critical registry keys
Unauthorized injection to a recently created process
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/72922/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo formbook nemesis overlay packed remcos shell32.dll zusy
Link:
https://www.filescan.io/uploads/640eedcf56d2bc8d80b71d45/reports/ea97ed0d-b92c-475e-960d-c7d17e729436/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/4dc1d7f5403f147bc8bd69fe671d86c1a990ed0c3727d07b757ef95fbcd232b9
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e15be092-bb79-4be2-b8e1-09685e6d31e8
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1192339
Signature
Antivirus detection for URL or domain
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found potential ransomware demand text
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample has a suspicious name (potential lure to open the executable)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses ipconfig to lookup or modify the Windows network settings
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 12377 Sample: HSBC Payment Advice_pdf.exe Startdate: 13/03/2023 Architecture: WINDOWS Score: 100 38 www.techwithsun.com 2->38 40 www.srscustomdesign.com 2->40 42 4 other IPs or domains 2->42 50 Snort IDS alert for network traffic 2->50 52 Malicious sample detected (through community Yara rule) 2->52 54 Antivirus detection for URL or domain 2->54 56 6 other signatures 2->56 12 HSBC Payment Advice_pdf.exe 19 2->12         started        signatures3 process4 file5 36 C:\Users\user\AppData\...\vvzosluykp.exe, PE32 12->36 dropped 15 vvzosluykp.exe 12->15         started        18 ipconfig.exe 12->18         started        process6 signatures7 76 Multi AV Scanner detection for dropped file 15->76 78 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 15->78 80 Maps a DLL or memory area into another process 15->80 20 vvzosluykp.exe 15->20         started        process8 signatures9 58 Modifies the context of a thread in another process (thread injection) 20->58 60 Maps a DLL or memory area into another process 20->60 62 Sample uses process hollowing technique 20->62 64 Queues an APC in another process (thread injection) 20->64 23 RAVCpl64.exe 20->23 injected process10 process11 25 control.exe 13 23->25         started        signatures12 66 Tries to steal Mail credentials (via file / registry access) 25->66 68 Tries to harvest and steal browser information (history, passwords, etc) 25->68 70 Writes to foreign memory regions 25->70 72 3 other signatures 25->72 28 explorer.exe 3 1 25->28 injected 32 firefox.exe 25->32         started        process13 dnsIp14 44 www.srscustomdesign.com 91.195.240.117, 49818, 49819, 49821 SEDO-ASDE Germany 28->44 46 www.techwithsun.com 50.3.253.169, 49816, 80 EONIX-COMMUNICATIONS-ASBLOCK-62904US United States 28->46 48 4 other IPs or domains 28->48 74 System process connects to network (likely due to code injection or exploit) 28->74 34 WerFault.exe 4 32->34         started        signatures15 process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4dc1d7f5403f147bc8bd69fe671d86c1a990ed0c3727d07b757ef95fbcd232b9/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-03-13 05:00:42 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jxa5p5kah4khxsf5nh7gohmgyguzb3img4t5a63vp34v7pgsgk4q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0f3e298df567408cd76e038782c3890da6b42514274555f57d2eb0c8117ebf15
Formbook
2e1feacb6a3980b6fe801af73c3eb68a60295d75e7a72fd0948091ba34a8d7d7
Formbook
3b34354c9ea63683e7d29da8afff9b0e52281d161f2cf246551d747ffdea6fd0
Formbook
658a6a08df776ba6ec5c1219fa0bc0226f9f810f247ae681de1fdd5b55954d6e
Formbook
6c63ea532f12715886930df03b9d1d27ef54eceaefe3572b1347a46f50a96e79
Formbook
8aa4a5feee91f2caa993c9624153ee2ecbe97098fc7470a5103c408376b2a12a
Formbook
bf71631457bec8633d10c816bfa914ef51bee4acda9a37c2613697976a21decb
Formbook
c03d796c8b75c36e92aa53d1fb21d89fb0fc6aa57df540ca0074c43661a6cec0
Formbook
dc8ac0ea14e9f418a35bd58f5f495282c9eb6a0e5331c197daf21f69f6d29222
Formbook
e6d190254a9da63d379fe136d687503b5b4f9eb34f1d45bb15bcca49aa92e79e
Formbook
+ 2'357 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230313-lh7rashf56/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Unpacked files
SH256 hash:
dd4b02f5f3ff857c5de6c4a84cfeac5b27f091f20baf2dd3bcc77616f0239f44
MD5 hash:
1096693fba6c51bd1f4487c0323faa80
SHA1 hash:
fcaf2530a525b85a0d7ce1db2dc72e34b43625e9
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/f0532fc6-50c5-4be2-81ac-f4d2bcdf1407/
Parent samples :
4dc1d7f5403f147bc8bd69fe671d86c1a990ed0c3727d07b757ef95fbcd232b9
fb2318f402521d3bd91b5d49df6e48f2b090074b7bf6b3e785e4b14a5df27e13
65ae1550333eb53329dab317b8f238dc060368d982b30a734ebdf0604d61a06c
5efbfab2a58f8e0b0c7d135fc020b123234ee1c56d81ecb760b3bae95db34e60
SH256 hash:
4a19856dbcfd1ed73ea288396c0f40e85824b5deda8605031362d6c5f298bfca
MD5 hash:
3176c95d2dc664ce6effc2085c360560
SHA1 hash:
c144ef31f3e0376b847c1f599311a56068570e11
Link:
https://www.unpac.me/results/f0532fc6-50c5-4be2-81ac-f4d2bcdf1407/
SH256 hash:
3bf3ed6a245662efc963da4b085f256f10d18f0215187e535e376d749c04e05a
MD5 hash:
b43f5aa7e768abb0f4ed72288c5b76b3
SHA1 hash:
92b6620384eb0c218ff16bf9adff940928734809
Link:
https://www.unpac.me/results/f0532fc6-50c5-4be2-81ac-f4d2bcdf1407/
SH256 hash:
4dc1d7f5403f147bc8bd69fe671d86c1a990ed0c3727d07b757ef95fbcd232b9
MD5 hash:
77cdc00597ec524e4d445a274a55a053
SHA1 hash:
6d0d79d464dac3a5ee563f5afabae73b0317fe20
Link:
https://www.unpac.me/results/f0532fc6-50c5-4be2-81ac-f4d2bcdf1407/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4dc1d7f5403f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4dc1d7f5403f147bc8bd69fe671d86c1a990ed0c3727d07b757ef95fbcd232b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.formbook.
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/373940/

Comments