MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 54f0db8ab08387aa0cee79b3ab7efeb0056d1aa9c46e36093db156ffa7fd29dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 8
| SHA256 hash: | 54f0db8ab08387aa0cee79b3ab7efeb0056d1aa9c46e36093db156ffa7fd29dc |
|---|---|
| SHA3-384 hash: | 02fdd33358ef4dd02023e6cc7afb4f057f4fe806581a09821b53fb4d99ade9beb98e52b2c24e235400da8e4ad950d549 |
| SHA1 hash: | e8d4962f5c4f59eb51cf4afd1271c8f7dfc35800 |
| MD5 hash: | 2c8e826cd328c462c087a91335114fa5 |
| humanhash: | venus-princess-foxtrot-mike |
| File name: | Doc-67789845678765670987652.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 204'117 bytes |
| First seen: | 2021-07-09 14:17:33 UTC |
| Last seen: | 2021-07-09 14:35:02 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 6e7f9a29f2c85394521a08b9f31f6275 (277 x GuLoader, 44 x RemcosRAT, 39 x VIPKeylogger) |
| ssdeep | 6144:nMm4CCgXr1QI1mqd1Ud2R+07onEqFAocMvaizL0h:nMwPrycd1UdEqWoVvih |
| Threatray | 5'885 similar samples on MalwareBazaar |
| TLSH | T1D81402143AB0C5D7D0E143364E3D26FB9DF8FA2714A4A24F67506B8D7E24392852FB42 |
| Reporter |  lowmal3 |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
166
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Virus heuristic.heuragen.1141442 RE PROOF OF PAYMENT.msg
Verdict:
Malicious activity
Analysis date:
2021-07-09 14:06:46 UTC
Tags:
trojan formbook stealer evasion
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
Win32.Spyware.Noon
Status:
Malicious
First seen:
2021-07-09 14:18:09 UTC
AV detection:
18 of 46 (39.13%)
Threat level:
2/5
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 5'875 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Unpacked files
SH256 hash:
d01f1b68cd4b87036d8ce4d307f76205b708cd0fcd0e757e6d2de206cd5ce4a0
MD5 hash:
a3a155e53969bb3c5b6e2c392d482f63
SHA1 hash:
42a5d86bc0dbffcb46435a34bafed0fe31332854
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
f6345306326f7a62179a7b17f1e3885b37cea16ab803eaa2f3841799a7b8a0ce
MD5 hash:
6dceff2a80f30f40c354dcf1b8c88325
SHA1 hash:
7be49fd8741f68f045e07916cd80fc9d8d9fb08a
SH256 hash:
552d42397b0797927894d25d32014bf25fa0c66461a2a591995c0d2c89867b49
MD5 hash:
53c68b917b4dd6598925a916a9c53d08
SHA1 hash:
99f32fc3669900415d9a840e82a3a7b5bc86acf3
SH256 hash:
54f0db8ab08387aa0cee79b3ab7efeb0056d1aa9c46e36093db156ffa7fd29dc
MD5 hash:
2c8e826cd328c462c087a91335114fa5
SHA1 hash:
e8d4962f5c4f59eb51cf4afd1271c8f7dfc35800
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.