MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5154c7f634096d8f89d99ef54a306761a6128936e6260ca5ea7d123cb6dac052. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5154c7f634096d8f89d99ef54a306761a6128936e6260ca5ea7d123cb6dac052
SHA3-384 hash:	eb530de24a4e2ac95b5a19a58960d7f162754b29373f40fc9ffeccc749ef5491c60c1cfe2079d70fa1a1162ede1a7d91
SHA1 hash:	e6ebbc7b866ecc4bdb2c4c613f5af079ddc78d5d
MD5 hash:	20374ec15334e8156f6c74fa622727a8
humanhash:	venus-five-illinois-five
File name:	Purchase Order .zip
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	388'053 bytes
First seen:	2023-10-02 14:29:53 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	6144:QD1u/ASar6XZnaiJdsjF1z0x1+2sAO/eGMo1ahmWv4909zRNmCOnJohQPGK/q42C:Q5SaHi/AF1on9+/f1wmWZ9z8nGQOyP2C
TLSH	T10D8423F3F9136408FC75E73A4B7CD60B8E5E04E9C81070AA7653BB16DD4D72980929AB
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	FormBook INVOICE zip

cocaman

Malicious email (T1566.001)
From: "Abdul Munir <office@sanres.ch>" (likely spoofed)
Received: "from [194.180.49.66] (unknown [194.180.49.66]) "
Date: "2 Oct 2023 16:28:22 +0200"
Subject: "PROFORMA INVOICE/Revise Invoice to Euro Currency"
Attachment: "Purchase Order .zip"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

88

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	ebede.exe
File size:	401'724 bytes
SHA256 hash:	738716f118a29c164740d59ca19da16459eef1c2de1758d9ffed42434c0b364a
MD5 hash:	b01746305f5f6173bc489cce8f144b71
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

DocGuard Unknown

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/5154c7f634096d8f89d99ef54a306761a6128936e6260ca5ea7d123cb6dac052/results/dashboard

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  5/10

Confidence:

100%

Tags:

control lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/651ad3ed8a37001eb1d893d2/reports/ec496dd7-fa49-4ced-b609-f49e643d3594/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/5154c7f634096d8f89d99ef54a306761a6128936e6260ca5ea7d123cb6dac052

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/5154c7f634096d8f89d99ef54a306761a6128936e6260ca5ea7d123cb6dac052

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5154c7f634096d8f89d99ef54a306761a6128936e6260ca5ea7d123cb6dac052/

ReversingLabs TitaniumCloud Win32.Trojan.FormBook

Threat name:

Win32.Trojan.FormBook

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-10-02 12:32:00 UTC

File Type:

Binary (Archive)

Extracted files:

4

AV detection:

18 of 35 (51.43%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kfkmp5rubfwy7cozt32uumdhmgtbfcjw4ytazjpkpujdznw2ybja._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/231002-sdvphabh2t/

Behaviour

Gathers network information

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5154c7f634096d8f89d99ef54a306761a6128936e6260ca5ea7d123cb6dac052