MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f698e8a2063767df2bdd680a5e982cbb54d63bd40a2e8abfd563201b9614a8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f698e8a2063767df2bdd680a5e982cbb54d63bd40a2e8abfd563201b9614a8e
SHA3-384 hash: 25534dcf2b6ff077c3b5f19c8a69419058af716a9bd149d6027560d63f94ddf4ef0cbd2adbdf3d7d62c825957984f52b
SHA1 hash: 48181915d4dfbc628a81f165c88c14bca63ee6ce
MD5 hash: ddfe75938385d1f1931d01a2f55fbdf6
humanhash: jig-burger-may-mars
File name:SecuriteInfo.com.Trojan.GenericKD.42890466.688.3374
Download: download sample
Signature FormBook
Create hunting rule
File size:135'168 bytes
First seen:2020-03-26 11:36:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 611723514fcf489d258006a0c9e575dd (1 x FormBook)
ssdeep 1536:ttkpWd6X/ksQtnjMBtjX305C6vai7aEkMPUvcIanPV:tC9ksEjKX3006xlPUvcIanPV
Threatray 961 similar samples on MalwareBazaar
TLSH 78D34B62F825DC51ED460E7C5E52C7F80A23FC202C21DA877A45BF8E29F6341A9B479D
Reporter SecuriteInfoCom
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Generic-7640581-0
Create hunting rule

Win.Dropper.Agent-7725907-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-03-25 23:59:21 UTC
AV detection:
22 of 30 (73.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j5uy5cramn3h34v522akl2mczo2u2y55icrork75kyzadolbjkha._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
012b683060a510c536e2aff1fabc3b4e7436923235754cb28fd3cc18c916eb4c
FormBook
042d9df5372defe8f9cf6f5f2373d82f6ddfe516216c58129321490da7933533
FormBook
071c9ef8d382452d6bcaa4a46eeb4a0e71562097201d228caf15229fd2b68ac9
FormBook
0f1f333f34d4ab91907ca6a0ad8d3360d5324623e9c885ab228127bce34932e5
FormBook
48b9908bc98ae2903ee34167224b402fe5eb3a6c9b853ab17e728de52e2639a0
FormBook
5e2170c1285ef31bc8c61c81280f3718c789454944ac56e310e12b77858a922b
FormBook
ced4cad0c45556ad653fa0b3f43e3312963f6d5e36f8eafe9bd5983a9b1480d6
FormBook
e162d29d0ba895e3ea7d75000c41c843225c7d29147b323ed9a72f4de3c1f6f0
FormBook
ef0116d9f61a26ad233dc3edc1990eb6c83b0398a593c65ef19f106008892eee
FormBook
fde7c52c166cd76fea454bbb539e7eba9ce704f5b442534bf5c4163213215426
FormBook
+ 951 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FormBook

Executable exe 4f698e8a2063767df2bdd680a5e982cbb54d63bd40a2e8abfd563201b9614a8e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/330208/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaObjSetAddref
MSVBVM60.DLL::EVENT_SINK_AddRef
MSVBVM60.DLL::__vbaLateMemCallLd

Comments