MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56d1fd3833355c32ff6d7f2a967fc8b601b5d3d2917d023482929a00edaae07e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56d1fd3833355c32ff6d7f2a967fc8b601b5d3d2917d023482929a00edaae07e
SHA3-384 hash: 2f18d98ae22c0fbc55583abbb0f185cc3b6f78706fa52028bd039166a91944da034e8307c6fbffc8d629ef68db9c6462
SHA1 hash: d48aa4ee9a275ff737e6a07327ecac50cba60af0
MD5 hash: a4a7c38caa4ce525ca19361d9f75ef67
humanhash: colorado-friend-kansas-georgia
File name:DM-PAYMENT .pdf.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:102'400 bytes
First seen:2020-04-06 05:42:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e0d59004d8e239f37129c15605488c97 (1 x FormBook)
ssdeep 768:YjsU0I/hvb3JbxxR6Ouc6iWOliKDHTSKGPONFYWVhFfwJggH+mhpqB:fU0ohvbZbxxlRZEJOTfw+gH1hpo
Threatray 370 similar samples on MalwareBazaar
TLSH A7A319267AA4FD24C4088E719D7AA7FE40647C70AC816E47B6C43F6E3C70581B6A6F47
Reporter jarumlus
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200406-0204.UNOFFICIAL
Create hunting rule

Win.Packed.Noon-7650558-0
Create hunting rule

Win.Malware.Generic-7650850-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2020-04-05 20:51:19 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k3i72obtgvodf73np4vjm76iwya3lu6ssf6qenecsknab3nk4b7a._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0232fe4b3256a6a4700de482e5e9074baf4548d7604cf4404182be73353ee32f
FormBook
059d904bf8c91b0171aea57256dd335f3a048c2fc3b9e0f2e8b129cac57b1f35
FormBook
0fc60e6149afb0a4a187d8d2d593a8939460ee688ca36091a825489e0d1ed399
FormBook
1889cc3d14163844c0ac599ded1dcbb904510b10d2ee4e5f03e3e2cf81040d79
FormBook
21339eb283369e13ec4129e6ba7cedfd84b67a40e9b297f367eadbce06edf0a2
FormBook
24e7c637d79dab5d54c17af32acb51ff82ea26b6a76ee58c22c4ef97254c09db
FormBook
92714bd064db14df090e83922023d6ebc0e515909e223e9277a35c570b0a36e0
FormBook
a3c2207806f9be710f3a1d1cbf1149a708bb080946e2368c8e826f5cef2293e4
FormBook
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
FormBook
f3baf6930fc7512bc2dab70e0dc2d898c699c102ba4b43f8553be70272ee165b
FormBook
+ 360 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaObjSetAddref
MSVBVM60.DLL::EVENT_SINK_AddRef
MSVBVM60.DLL::__vbaLateMemCallLd
MSVBVM60.DLL::__vbaErrorOverflow

Comments