MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 52b517b0e9be1efed3349ff5b7e7e4a392881437d7bc9ccd7b94bbc23e28a2f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 4
| SHA256 hash: | 52b517b0e9be1efed3349ff5b7e7e4a392881437d7bc9ccd7b94bbc23e28a2f9 |
|---|---|
| SHA3-384 hash: | 6ec82fc95f7f52f98f74345b7ee43593cb601b518922b12d9a1d904aca732f284e8dde5a9dfceb25fd213cf8007d6477 |
| SHA1 hash: | b5ee2386390621aeb724820cc4fa3ce81792fcd1 |
| MD5 hash: | 505fd01868648084fe3823eb1d42b024 |
| humanhash: | winter-nevada-alaska-tennessee |
| File name: | 57583c08f62e6451d1f9147103fe5f8c.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 172'032 bytes |
| First seen: | 2020-04-09 18:28:21 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| ssdeep | 3072:vk629DPwlwvvye18fnNPXj6qHMJ74jHckl//BXL4Efj3DEZfCXQiOe:c9cJeytjxH07W8klB0Ef/sf8jOe |
| Threatray | 5'107 similar samples on MalwareBazaar |
| TLSH | A0F3AE31D641C035E2B251B5F67D0B7B883E4E34329564F6E3B52AA06FA44A5F42E31F |
| Reporter |  abuse_ch |
| Tags: | exe FormBook GuLoader |
abuse_ch
Payload dropped by GuLoader from the following URL:https://drive.google.com/uc?export=download&id=1ai-YOkwECbZKHyxZE6AWzmAVFp5Aj4qU
Intelligence
File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Formbook
Status:
Malicious
First seen:
2020-04-09 18:35:48 UTC
File Type:
PE (Exe)
AV detection:
31 of 31 (100.00%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
netwirerc
Similar samples:
+ 5'097 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
22334d4341ded8f8d453fad36b3bf9d490c9d2139be3d5fcb3b3b627d0cf348f
Dropped by
MD5 57583c08f62e6451d1f9147103fe5f8c
Dropped by
MD5 65458dd04a7eaaa1f14654c8150021db
Dropped by
GuLoader
Dropped by
SHA256 22334d4341ded8f8d453fad36b3bf9d490c9d2139be3d5fcb3b3b627d0cf348f
Dropped by
SHA256 99221889e7e8f622e84b1f953bfb44fd1bbd9a5ab9ceafaf884ef8deb5946805
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.