MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56468c37d2d31a1b45161098c2ebcbd1fd9648ed823ba74f67fcaf7bcb66868e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 22 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56468c37d2d31a1b45161098c2ebcbd1fd9648ed823ba74f67fcaf7bcb66868e
SHA3-384 hash: 746dc4d3d6960a3b94d184d63eb519bce8f0e3ebaddf923afac713d60a84e2342949eb8c49868771a8ec92c62b3e6da4
SHA1 hash: 27d4e5288090953daa89183eef7cf3e88d34d23a
MD5 hash: 4fa57634e5b041652fc685ce388a85b6
humanhash: papa-uranus-november-vegan
File name:ZAMÓWIENIE-761396939049.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:763'392 bytes
First seen:2023-12-07 08:18:20 UTC
Last seen:2023-12-07 10:21:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:kHqc3+GCueH5qSwewWk8WD8iCISjBmDWqMQY10Z01jhn/WuexaoNkHC:kH/uG2qSwerDWDxCI4kWXvd/WueIoNki
Threatray 270 similar samples on MalwareBazaar
TLSH T1BEF4124437B9A363F9BE9BF428A66100177ABD2F6571D28C4C5560CD063AF828761FB3
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter Anonymous
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
327
Origin country :
PL PL
Vendor Threat Intelligence
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Creating a process from a recently created file
Creating a file
Сreating synchronization primitives
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a recently created process
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/56468c37d2d31a1b45161098c2ebcbd1fd9648ed823ba74f67fcaf7bcb66868e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6ce098db-af65-47f5-8937-85d1abcb0ee5
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1355250
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1355250 Sample: ZAM#U00d3WIENIE-761396939049.exe Startdate: 07/12/2023 Architecture: WINDOWS Score: 84 17 Malicious sample detected (through community Yara rule) 2->17 19 Multi AV Scanner detection for submitted file 2->19 21 Yara detected FormBook 2->21 23 4 other signatures 2->23 7 ZAM#U00d3WIENIE-761396939049.exe 3 2->7         started        process3 process4 9 ZAM#U00d3WIENIE-761396939049.exe 7->9         started        11 ZAM#U00d3WIENIE-761396939049.exe 7->11         started        13 ZAM#U00d3WIENIE-761396939049.exe 7->13         started        process5 15 WerFault.exe 22 16 9->15         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/56468c37d2d31a1b45161098c2ebcbd1fd9648ed823ba74f67fcaf7bcb66868e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/56468c37d2d31a1b45161098c2ebcbd1fd9648ed823ba74f67fcaf7bcb66868e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-12-06 16:11:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
27
AV detection:
18 of 23 (78.26%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kzdiyn6s2mnbwriwccmmf26l2h6zmshnqi52ot3h7sxxxs3gq2ha._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1b406a68c4eafc78f127b013623b0d64d07b8a586ccd7fc6ebab8254fea0a469
Formbook
4e40765dcf57e97677b1e5ed922e0810ba581de04a80b684960f0eb7dac73825
Formbook
76b695c17786615cfe769077dde4f7d7dae83e8a6f638680c9e0e59b8d1f582c
Formbook
8f7cb04a6268c63d92bc906acd0c69179d7425b3ed4b72ac045748718d7652d3
Formbook
af577fba54197b9d6d539da592156b01e7ceafccf01e515c1255f9896cadbfd5
Formbook
ece7b97dcb7fcba52f0b348578e52178bbb7bcc22540ed9123997b90c14323e8
Formbook
+ 260 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/231207-kbkgragd69/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
e8b224e8084b26bc1900b890cbe4ce8484c21a6f7669f964049e67b25f4825cd
MD5 hash:
296a7928a0a17e9926edc09fde191ed3
SHA1 hash:
278be4202d6de8f75268c35ecee57827258b59d7
Link:
https://www.unpac.me/results/60d653b7-1141-4c8f-94b4-0c329aa9e021/
SH256 hash:
c516fa6d911a9a818469a610bcfd2e3a080450773353e6fd31ae8868940913b8
MD5 hash:
52f5d2a584aff291656efaf7c0d82fde
SHA1 hash:
33a2667c1de4b9678ca767e326d38bc5a1cd24af
Link:
https://www.unpac.me/results/60d653b7-1141-4c8f-94b4-0c329aa9e021/
SH256 hash:
797e57bd74a68f7b4808a213f5c319ee4f4b023bc73088175d4393dfee9fe329
MD5 hash:
3c927935fbd608e7628cc2c5ad7d52fd
SHA1 hash:
ee0c880c0614ac960fd641f7d479233584aed1d8
Link:
https://www.unpac.me/results/60d653b7-1141-4c8f-94b4-0c329aa9e021/
SH256 hash:
e72b64e3119db4738c1525a4f336d9343da4196939b9e38143c684b5f1e1b5aa
MD5 hash:
dde684e9f1482a79b0dc510cb9f5fcf9
SHA1 hash:
a39dddb3e0d3408e46b7ec63ec0477fd613b4546
Link:
https://www.unpac.me/results/60d653b7-1141-4c8f-94b4-0c329aa9e021/
SH256 hash:
715763bb2de380854e3dc9a87ddd571387dff186394c769dba8b45267118b6e0
MD5 hash:
a3cfd86b84c5f96b171e928caf66e57f
SHA1 hash:
a32d92ecd049a3d821a139f67952075b31c0c8e7
Link:
https://www.unpac.me/results/60d653b7-1141-4c8f-94b4-0c329aa9e021/
SH256 hash:
56468c37d2d31a1b45161098c2ebcbd1fd9648ed823ba74f67fcaf7bcb66868e
MD5 hash:
4fa57634e5b041652fc685ce388a85b6
SHA1 hash:
27d4e5288090953daa89183eef7cf3e88d34d23a
Link:
https://www.unpac.me/results/60d653b7-1141-4c8f-94b4-0c329aa9e021/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/56468c37d2d3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/56468c37d2d31a1b45161098c2ebcbd1fd9648ed823ba74f67fcaf7bcb66868e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Formbook
Create hunting rule
Author:kevoreilly
Description:Formbook Payload
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments