MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 57e20958192afa8402b59845234ba6b302a654d2eb75dd71273b8aa0ff115ff2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 12
| SHA256 hash: | 57e20958192afa8402b59845234ba6b302a654d2eb75dd71273b8aa0ff115ff2 |
|---|---|
| SHA3-384 hash: | acbf7acc0d3961ee520da4096b67da1544b5795eceaafe26e18697dcd8c227134f0b1df9fea7b39e8af5cea63e132cd7 |
| SHA1 hash: | 0c1d0f183fa421b99ecb0617b01f4a642a1a31ad |
| MD5 hash: | e65c8c91114309409d7fd9e014b4e425 |
| humanhash: | oven-blossom-bacon-lake |
| File name: | PROFORMA INVOICE PI160256.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 660'480 bytes |
| First seen: | 2023-05-24 08:28:58 UTC |
| Last seen: | 2023-06-15 22:26:43 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:RYtPplTY6RhKuVEzvScqAmExlZ+/TqDUZmNCpuGeZemCmyoPbVHn0g8:iJTDEIEF5JZ+l5uGeZcCPN0g |
| Threatray | 2'917 similar samples on MalwareBazaar |
| TLSH | T17EE422092F0FA42FD5EF1BFC845415B0227B8A96B682F347AE6733D5DA85F86500588B |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer) |
| Reporter |  lowmal3 |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
269
Origin country :
DEVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PROFORMA INVOICE PI160256.exe
Verdict:
No threats detected
Analysis date:
2023-05-24 08:31:01 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Creating a file
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj
Score:
80 / 100
Signature
Antivirus / Scanner detection for submitted sample
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Leonem
Status:
Malicious
First seen:
2023-05-24 02:40:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
18 of 35 (51.43%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'907 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
f1fcce7a0b22d9d87cc0393d6ddd052c8d2a233435e769771144e8ffd87beabc
MD5 hash:
55768e9cd2597b4bdb71551c4c266dfa
SHA1 hash:
62a7af356b42a915791b4f3150876b1258f78470
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
775cb3a191a4e3885de59395c77514f70202f0772a9a85530691eab441329c48
MD5 hash:
f514a3784e3d600a27180bf905cf09db
SHA1 hash:
e40e5c2f2a2aa08e927a2a55487a9bef26ca0946
SH256 hash:
654936dd6086b8a61dd8719f870a1e09c924ab485f1c98fa8a671fb32575dae5
MD5 hash:
e6df3e3a094f8f2f90e9c321edb63af3
SHA1 hash:
ad425c9fdffc6bae9b3d070a1d8d387506270dbe
SH256 hash:
48a6c6305f8af7ab67ddbd89241005522a05422656a1a72955fadbc88b06c801
MD5 hash:
8b22bd0613c675136976d356491171a4
SHA1 hash:
5fabd975bdc9eed21a8e8f0799ad84a27229e63d
SH256 hash:
a518e0fddabae1e59f933566cb54e592331404d5362976f3ef81a1432dac4ffb
MD5 hash:
de906fce89f615f303ddfb80c1b37b35
SHA1 hash:
3568e3f9f0731da9a3294f4f8de61f95dc3eec31
SH256 hash:
583abe7cf9d23804de162b72368fe4aaf1f81333f565a2aee706e6db681e76db
MD5 hash:
49b45e53d1213c6cdc56b3b9ea6f9881
SHA1 hash:
18adc138dc57765c6e0f43d2241b1a5c8e2ae483
SH256 hash:
57e20958192afa8402b59845234ba6b302a654d2eb75dd71273b8aa0ff115ff2
MD5 hash:
e65c8c91114309409d7fd9e014b4e425
SHA1 hash:
0c1d0f183fa421b99ecb0617b01f4a642a1a31ad
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.