MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 513cd5b944505e73da6d58a6774411cddbd339c0a51132654ca3ef848112d01d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 513cd5b944505e73da6d58a6774411cddbd339c0a51132654ca3ef848112d01d
SHA3-384 hash: ef251e90a73c467e564aab1932fb00addb2926b1f7d79aa694ab6e89d6b97055e9b9965edae1c42c3e281bd12f2f5cdd
SHA1 hash: e1ac62e684ec2163bebddd5310eb1142dc453af2
MD5 hash: 8a56679348f4761d722d680cd00be9a2
humanhash: east-oranges-batman-ten
File name:Order.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:937'984 bytes
First seen:2023-06-15 07:13:23 UTC
Last seen:2023-06-18 12:05:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:Qy4s3y5s0sxIhgySbbWyZjqdCJjKqC4+xryqtRNuS0f3+:Qy4DEICbbZmd+ZSx7iu
TLSH T1B61594B82940266BD776EE7641E2044BF27B7727B2139D9826D213C6472150F3BEDA0F
TrID 60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.8% (.SCR) Windows screen saver (13097/50/3)
8.7% (.EXE) Win64 Executable (generic) (10523/12/4)
5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter cocaman
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
280
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Order.exe
Verdict:
Malicious activity
Analysis date:
2023-06-15 07:15:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/09a15c33-d164-4389-ab31-b12b42c7be23

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/399046/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.25328.10759.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin packed
Link:
https://www.filescan.io/uploads/648aba3c416f5c526e222311/reports/1305bb96-a10f-4b2c-a8db-29fa295d6c10/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/513cd5b944505e73da6d58a6774411cddbd339c0a51132654ca3ef848112d01d
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/babb884a-7b39-4323-8bea-730537a0e28a
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1255081
Signature
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/513cd5b944505e73da6d58a6774411cddbd339c0a51132654ca3ef848112d01d/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-06-15 07:13:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ke6nlokekbphhwtnlcthorarzxn5gooauuitezkmupxyjais2aoq._file
Verdict:
suspicious
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230615-h2mzfsfa73/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
552a5e1ce45b7a9066838996135db1bf15ab4107b61a3bad65e5e42297bc32f8
MD5 hash:
065e5b189998eca4a0a814b701a62728
SHA1 hash:
7af7383fce382b81684ad6a518eccd2a8a839b7c
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/ed45a43b-eff6-4027-972a-8210f33e1816/
SH256 hash:
0740244e4d40663476180ed0ec369cea7d996d51baa2f6881fdef345233bf36e
MD5 hash:
55a6efe713d27dbf4c28b42cbf25c961
SHA1 hash:
012fe874881a102ec401d4a651295f90088f002e
Link:
https://www.unpac.me/results/ed45a43b-eff6-4027-972a-8210f33e1816/
SH256 hash:
50b224aa5cbf278ebbd6735f82a453307fac9b9e1ac07f0d908761ced1480ada
MD5 hash:
95a555c0a90b9f7c8dccf5e413bda6fb
SHA1 hash:
e7cbc1cd65d9b80a89656eae39c53d4dfc92fd8a
Link:
https://www.unpac.me/results/ed45a43b-eff6-4027-972a-8210f33e1816/
SH256 hash:
332a250eba711fe7145e3b4b19615b100343c644f2dca24703c5c78d6652bb0a
MD5 hash:
b513649ad5e52db41a4d6ef16afef1ef
SHA1 hash:
7d6465448a3441e44b9c5f63b1cd196c64048f00
Link:
https://www.unpac.me/results/ed45a43b-eff6-4027-972a-8210f33e1816/
SH256 hash:
513cd5b944505e73da6d58a6774411cddbd339c0a51132654ca3ef848112d01d
MD5 hash:
8a56679348f4761d722d680cd00be9a2
SHA1 hash:
e1ac62e684ec2163bebddd5310eb1142dc453af2
Link:
https://www.unpac.me/results/ed45a43b-eff6-4027-972a-8210f33e1816/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/513cd5b944505e73da6d58a6774411cddbd339c0a51132654ca3ef848112d01d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 22214fd32b545edd15b7beea54a693ba56a36fedba79856f6678cfcc62c54b7c

Formbook

Executable exe 513cd5b944505e73da6d58a6774411cddbd339c0a51132654ca3ef848112d01d

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 22214fd32b545edd15b7beea54a693ba56a36fedba79856f6678cfcc62c54b7c
Cape
Cape
https://www.capesandbox.com/analysis/399046/
  
Dropped by
MD5 0758d1d2fe040ca1f93df51d257343ba

Comments