MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5243b249b82fb33756ce0f6fd1daf1d556745e325d52a903903aa96a62436bd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 25 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5243b249b82fb33756ce0f6fd1daf1d556745e325d52a903903aa96a62436bd3
SHA3-384 hash: 7800a9da852626ce57cef76a111907b0f6fa16af65875c1cbb8c1086da9a60ae98c61b228b83dac15bea84b5471fcea2
SHA1 hash: 48f03830d28260d7d5e0f2d8dd30665235986e2d
MD5 hash: 900ecb152e5f2de0be3c7fbd061f3415
humanhash: wolfram-sweet-venus-virginia
File name:nPLN.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:758'280 bytes
First seen:2024-05-18 01:24:48 UTC
Last seen:2024-05-18 02:45:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:LdrLbDZaNRp8PscMpoxfc0uKFnNNQpLYX+AJmxNiu00pc14/P+RakR:ZLDZMRp8PjMIFuuNKAq/XWu/2R5
Threatray 18 similar samples on MalwareBazaar
TLSH T111F423CA6DBDD154CDAE0B3090F9A33AD772D3261916D32D4ABD81CD1A93BE463016CE
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter kafan_shengui
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
283
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5243b249b82fb33756ce0f6fd1daf1d556745e325d52a903903aa96a62436bd3.exe
Verdict:
Malicious activity
Analysis date:
2024-05-18 01:49:25 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7770233c-6fec-49b0-9760-ad3c21406aac

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2846.5286.29556.UNOFFICIAL
Create hunting rule

Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/664803914a6f56bc5c90121c/reports/2e9bc471-5b9d-4ead-ad3c-c02a2c8ff0f0/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/5243b249b82fb33756ce0f6fd1daf1d556745e325d52a903903aa96a62436bd3
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/54ede1e7-6904-4521-b622-f4ca7b86b4bb
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1443620
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses nslookup.exe to query domains
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1443620 Sample: nPLN.exe Startdate: 18/05/2024 Architecture: WINDOWS Score: 100 27 www.vpachurch.org.uk 2->27 29 www.shortput.top 2->29 31 20 other IPs or domains 2->31 47 Snort IDS alert for network traffic 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Antivirus detection for URL or domain 2->51 53 8 other signatures 2->53 10 nPLN.exe 3 2->10         started        signatures3 process4 process5 12 nPLN.exe 10->12         started        signatures6 57 Maps a DLL or memory area into another process 12->57 15 gDCzuyabGBTOmXRnCyhTFpawEePRh.exe 12->15 injected process7 signatures8 59 Uses nslookup.exe to query domains 15->59 61 Found direct / indirect Syscall (likely to bypass EDR) 15->61 18 nslookup.exe 13 15->18         started        process9 signatures10 39 Tries to steal Mail credentials (via file / registry access) 18->39 41 Tries to harvest and steal browser information (history, passwords, etc) 18->41 43 Modifies the context of a thread in another process (thread injection) 18->43 45 2 other signatures 18->45 21 gDCzuyabGBTOmXRnCyhTFpawEePRh.exe 18->21 injected 25 firefox.exe 18->25         started        process11 dnsIp12 33 www.shortput.top 203.161.43.227, 49740, 49741, 49742 VNPT-AS-VNVNPTCorpVN Malaysia 21->33 35 betopfloor.com 108.179.192.228, 49752, 49753, 49754 UNIFIEDLAYER-AS-1US United States 21->35 37 12 other IPs or domains 21->37 55 Found direct / indirect Syscall (likely to bypass EDR) 21->55 signatures13
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5243b249b82fb33756ce0f6fd1daf1d556745e325d52a903903aa96a62436bd3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5243b249b82fb33756ce0f6fd1daf1d556745e325d52a903903aa96a62436bd3/
Threat name:
Win32.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2024-05-17 04:54:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kjb3esnyf6ztovwob5x5dwxr2vlhixrslvjksa4qhkuwuysdnpjq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0cb284abb63cf61b070bfa0a5250ff536f92907bbf5eec07070b9aeafa4ac2bd
Formbook
19b86526b9c8b33ee230bba95c8a02fc47db4d230933c3ebcb6888e0dd344f77
Formbook
37fd7b8035bd49b8dfad405a793428dda8cbf623de0133818756d05a1191d8b7
Formbook
4b98d799aec5026f2903adc659e69f7ccaeda9da2f71a4b43450f1204e090694
Formbook
5243b249b82fb33756ce0f6fd1daf1d556745e325d52a903903aa96a62436bd3
Formbook
bf1f882e2a1d0e35207cd7cab867bffe933e134e43ff317acf2db538bd4d7210
Formbook
d0b94b855d2f24add1edf6b3a6ecae24e4366f181a1ccd0bcd3b27e94de95bc0
Formbook
f7decb942c4d2f001d2f810978463780697403597ed4f5102a19c27edd649ce3
Formbook
+ 8 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240518-bsy7ssde81/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
ea9eef71655ad92fb314ddf37633b88f23eebeffde6d547fe51c3fa662a9e9bc
MD5 hash:
f81207e10a74338541e8723a6a417124
SHA1 hash:
4e1e5af4c43fac8d1c52e3d8ad7879cdbc2492c1
Link:
https://www.unpac.me/results/5799347f-28c3-4aa7-8d05-1723a0bce422/
SH256 hash:
ebf469c46d04df3e52eb8690219f91dfcc6d0f29ec0c382155041f6da8537c39
MD5 hash:
8290a941e1129be99cf08f0e5ce5e1c1
SHA1 hash:
33161ef23a5ed447dc35a8b61b37705525dfdb9d
Link:
https://www.unpac.me/results/5799347f-28c3-4aa7-8d05-1723a0bce422/
SH256 hash:
a13c3bdf634477fa29c8364adb717f0c3b08967f2ef94d3aac36736231026a1a
MD5 hash:
2bafe3a29094a33403b83b3dbe7369f8
SHA1 hash:
ebeff033d50a05a1e401cf7bf9309ad392e5b3cd
Link:
https://www.unpac.me/results/5799347f-28c3-4aa7-8d05-1723a0bce422/
SH256 hash:
f540e8d603962027b3a1f8b86d035281bfbdd3a05a621ead255825bc2082632a
MD5 hash:
d172f59251b97b415b621d302e1be2b7
SHA1 hash:
b1534e603749c901b5ac185f20e281f6be7fa908
Link:
https://www.unpac.me/results/5799347f-28c3-4aa7-8d05-1723a0bce422/
SH256 hash:
67fe0febbbfb65deab3988ed8f451cff43fc3ada4f167450d7f847300a70cad0
MD5 hash:
c6b3e366ed97f19f4877631dd3d7123d
SHA1 hash:
a97ca79183dc12c362da2167fbb4afff62e210be
Link:
https://www.unpac.me/results/5799347f-28c3-4aa7-8d05-1723a0bce422/
SH256 hash:
5243b249b82fb33756ce0f6fd1daf1d556745e325d52a903903aa96a62436bd3
MD5 hash:
900ecb152e5f2de0be3c7fbd061f3415
SHA1 hash:
48f03830d28260d7d5e0f2d8dd30665235986e2d
Detections:
INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Link:
https://www.unpac.me/results/5799347f-28c3-4aa7-8d05-1723a0bce422/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5243b249b82f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/5243b249b82fb33756ce0f6fd1daf1d556745e325d52a903903aa96a62436bd3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Formbook
Create hunting rule
Author:kevoreilly
Description:Formbook Payload
Rule name:INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments