MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50b7c22b62b792c34ad69ec219ee468803d070257b57902a33248f953444caf7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50b7c22b62b792c34ad69ec219ee468803d070257b57902a33248f953444caf7
SHA3-384 hash: b7af49e357933acf8e508bfcf0f46184d74c1dd7ed6bd9c1eefa6dbf68e113bcf3845ebb34b47f7346faecd51f02c03b
SHA1 hash: 9bde167acf3f4146c339c62d212280d7c2b96391
MD5 hash: 0bb376187cf8242293fcb8578e369fb2
humanhash: mike-wolfram-bacon-equal
File name:97E76B9110FF4A56835C3827725D04C7.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:589'824 bytes
First seen:2023-09-20 17:29:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:6ZUEkSVn/1nKAjj7N14+l8QvbV5yu1Dm30IsQ456V614sAAk08:2UqVjjPl8m5ZTKSAO
Threatray 2 similar samples on MalwareBazaar
TLSH T11CC423172694CD91E2AA977914726AC73B3BBDD7793AF3A84C9A50C70E01E018343BD7
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
298
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
97E76B9110FF4A56835C3827725D04C7.exe
Verdict:
No threats detected
Analysis date:
2023-09-20 17:30:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/245df63b-a308-46f3-b9d4-a3a65c05dc0d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/450141/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.9981.14828.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/650b2c1b32ffdb7a7a0d821d/reports/ff2167f1-4880-41f4-a822-edddc705fd3a/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/50b7c22b62b792c34ad69ec219ee468803d070257b57902a33248f953444caf7
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5ea2f805-0466-427d-b44d-7c23982e4cc2
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1311801
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/50b7c22b62b792c34ad69ec219ee468803d070257b57902a33248f953444caf7/
Threat name:
ByteCode-MSIL.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2023-09-20 14:57:34 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
22 of 35 (62.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kc34ek3cw6jmgswwt3bbt3sgrab5a4bfpnlzakrteshzkncezl3q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
96a3709a8156268f9daaeac2aab9c66146967ef173e5d5d2e8a0ed8bde75ab63
Formbook
b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a
Formbook
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230920-v26g1sbf93/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
4e1d0acd8df0963ae1023673fd70de7002e0b09ca934b85599424b3946874b73
MD5 hash:
28639e0149e13d41b1610e84202f72bb
SHA1 hash:
6eebf71af746de9df8923e4e7363e8cf65a492f7
Link:
https://www.unpac.me/results/6a4a083f-9402-4dee-92e2-0ecbb2c55852/
SH256 hash:
a7dbdc2baafb2900d0c7c13a64217b4b5c09fe673631f0b9126c027380d93799
MD5 hash:
8658e3c2989701cced085171fdac955a
SHA1 hash:
e4c7caca0a993bdbfbde6d14d26b22435151ad60
Link:
https://www.unpac.me/results/6a4a083f-9402-4dee-92e2-0ecbb2c55852/
SH256 hash:
513d832b6414ca92f71ea7abb910113140519f343c8fee079825d19bec37cae6
MD5 hash:
128feef2cd97a2ee0d369655ab39f214
SHA1 hash:
90d82fff31ca1510bdc670c400faa2893c918341
Link:
https://www.unpac.me/results/6a4a083f-9402-4dee-92e2-0ecbb2c55852/
SH256 hash:
722286fcc6cc31c96a8923b7eaa70ffd821745f11d8598d86bc9c5e900a66a55
MD5 hash:
02a8a28c663cda88ac46466952096f66
SHA1 hash:
72981ef59fe1d7923632bca9397a361e9bc295e0
Link:
https://www.unpac.me/results/6a4a083f-9402-4dee-92e2-0ecbb2c55852/
SH256 hash:
61ecfa8c32358481df0464b4a9d40fdba62ba988d0cbc62aed1700e43a897241
MD5 hash:
d9b9db343f5abecbf1be60d8fda4223e
SHA1 hash:
1a1641d236333d430acff525f8dcb8e9658a420d
Link:
https://www.unpac.me/results/6a4a083f-9402-4dee-92e2-0ecbb2c55852/
SH256 hash:
50b7c22b62b792c34ad69ec219ee468803d070257b57902a33248f953444caf7
MD5 hash:
0bb376187cf8242293fcb8578e369fb2
SHA1 hash:
9bde167acf3f4146c339c62d212280d7c2b96391
Link:
https://www.unpac.me/results/6a4a083f-9402-4dee-92e2-0ecbb2c55852/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/50b7c22b62b792c34ad69ec219ee468803d070257b57902a33248f953444caf7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/450141/

Comments