MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 55979041c0dde9e724da45ec9d88c717a18b0fb414adc96fce5387ce9b6e772b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 10
| SHA256 hash: | 55979041c0dde9e724da45ec9d88c717a18b0fb414adc96fce5387ce9b6e772b |
|---|---|
| SHA3-384 hash: | 9ca2bf59c75b093b9db7b5e0597c4facc23fb575856a91b4f60fe5c8c1e42eee0118ac518a9a2dc24aaf4d756e2a7ff9 |
| SHA1 hash: | 15dd99a08a143114f4c3f99426eca6d6a2e9f684 |
| MD5 hash: | dd9c4e8460227266b5d380389e7d9ccc |
| humanhash: | ack-montana-missouri-louisiana |
| File name: | DHL AWB 45000289000.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 656'896 bytes |
| First seen: | 2023-08-14 09:26:53 UTC |
| Last seen: | 2023-08-14 09:28:27 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 12288:Xaf4lrrnqECLTToAhp0kJjQNK683vZraQdasgROLYsanaqZ661A:Xe4lXnULfoAhGkx68/ZeQdNtB61A |
| Threatray | 3'724 similar samples on MalwareBazaar |
| TLSH | T1B9D4CDC2E57AD6E3C5A696B1309202001F787FC57162D2A54CBA32D976F0B023797A3F |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  abuse_ch |
| Tags: | DHL exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
281
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL AWB 45000289000.exe
Verdict:
No threats detected
Analysis date:
2023-08-14 09:28:33 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Creating a window
Unauthorized injection to a recently created process
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
68 / 100
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Leonem
Status:
Malicious
First seen:
2023-08-14 07:53:30 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
24 of 38 (63.16%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 3'714 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
7730ae17d9d094aff519f1ac8773cc626649d4f5cb207f761f4d149b82dc0487
MD5 hash:
1d8af0632a56700f4b2059357ce10512
SHA1 hash:
c704dcd56d5a56b765c4c6a0e4104ba5907fb0ff
SH256 hash:
c584d64074b1eab58528dbc721935cfbe7badb78ba7c5d6256672b930482899c
MD5 hash:
8b5e647756c43148994949e762bf1c79
SHA1 hash:
7dfa33663944849e9bb7f512462aa6a6c5805253
SH256 hash:
88aa0473343b85ec5946994286d9cd9181f6c498ba90d63135db2fbe3fdba8a6
MD5 hash:
2ccf9ecd3918363dbc925b1f4b4e966a
SHA1 hash:
31b8e86b9cacc26dc7fb14fe8e5bef6b2ea6a1c7
SH256 hash:
7b1e678c7c4eee7e46e6cfbd53bb95989e81b129d289bca515545a19a6e02a58
MD5 hash:
69d3955a4822a33a3019d1c11458205b
SHA1 hash:
de29084906a9d27fb055e35d4b9615fc4d357093
SH256 hash:
2ac2f55e15fd8da559f99925ceee9166ca978e94cbc53a5cb29bf02d0a76ac7f
MD5 hash:
1081db0b25581c7958e6fbff4d9aa64a
SHA1 hash:
bcb0e0fe844884a5b0d05cd3b0cc5fd7a5ff53b9
SH256 hash:
5fcef6a3aa1823fcbecb79e59307a9cf75c6e4b46055ed183cc81dfd55520b85
MD5 hash:
d8dc4c7e30800a00605c6e89e4fe6b68
SHA1 hash:
085121c7eeca835bc26621b78333b17ff8a89a40
SH256 hash:
55979041c0dde9e724da45ec9d88c717a18b0fb414adc96fce5387ce9b6e772b
MD5 hash:
dd9c4e8460227266b5d380389e7d9ccc
SHA1 hash:
15dd99a08a143114f4c3f99426eca6d6a2e9f684
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.