MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 582c078327541d1459228aebf38c9471b78e3a2c03cb9c375622209221970709. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 18

Intelligence 18 IOCs YARA 16 File information Comments

SHA256 hash:	582c078327541d1459228aebf38c9471b78e3a2c03cb9c375622209221970709
SHA3-384 hash:	79ef6a3c28718386b210c1feaff3527e1ee993b4210e1ed5454be2b85f8c4134a29fcd06d52e0bceaf41f0eaa282719a
SHA1 hash:	46b52ec65561265ed8936cbe1a4fdf417d87d629
MD5 hash:	2f2be19e7df6549682b6db140841ef0c
humanhash:	mike-magnesium-four-low
File name:	REVISED SOA 19-03-25 PDF.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	645'632 bytes
First seen:	2025-03-24 06:54:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	12288:+cTjvOn6nzxQkjZGhGZJd60sqQ0Om1lEWnBynQa44F8+19tNW3:Jj2n6n2ktGhGcVxyyMByQj4F8+19tw
TLSH	T142D401A85726E616C6A623740E71F27513FC1EDEB805E3079FE9AEDFBD25E004C44292
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	cocaman
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

404

Origin country :

Vendor Threat Intelligence

Malware family:

formbook

ID:

File name:

REVISED SOA 19-03-25 PDF.exe

Verdict:

Malicious activity

Analysis date:

2025-03-25 04:50:06 UTC

Tags:

formbook stealer xloader

Link:

https://app.any.run/tasks/ec439fde-b9fc-4606-b030-cc8d0928dfca

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67e198cabb84e066269e9482

Tags:

micro spawn msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a process with a hidden window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a file in the %temp% directory

Launching a process

Creating a file

Launching cmd.exe command interpreter

Setting browser functions hooks

Adding an exclusion to Microsoft Defender

Enabling autorun by creating a file

Unauthorized injection to a system process

Unauthorized injection to a browser process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/67e101cdde7b23ce171ca1a6/reports/8a1d20c5-2f4b-4d5b-b4d5-fc33eed41062/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/582c078327541d1459228aebf38c9471b78e3a2c03cb9c375622209221970709

Result

Verdict:

MALICIOUS

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1646719

Behaviour

Behavior Graph:

n/a

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/582c078327541d1459228aebf38c9471b78e3a2c03cb9c375622209221970709

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/582c078327541d1459228aebf38c9471b78e3a2c03cb9c375622209221970709/

Threat name:

ByteCode-MSIL.Backdoor.FormBook

Status:

Malicious

First seen:

2025-03-24 06:54:17 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lawapazhkqoriwjcrlv7hdeuog3y4ormapfzyn2weiqjeimxa4eq._file

Verdict:

malicious

Label(s):

unc_loader_037

formbook

Similar samples:

error

Formbook

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:a03d discovery execution rat spyware stealer trojan

Link:

https://tria.ge/reports/250324-hptlgassby/

Behaviour

Enumerates system info in registry

Modifies registry class

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Formbook payload

Formbook

Formbook family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/20611c45-3aaf-44b5-8e45-d7908a76a0fc

Unpacked files

SH256 hash:

582c078327541d1459228aebf38c9471b78e3a2c03cb9c375622209221970709

MD5 hash:

2f2be19e7df6549682b6db140841ef0c

SHA1 hash:

46b52ec65561265ed8936cbe1a4fdf417d87d629

Link:

https://www.unpac.me/results/18716411-3c10-4dc6-84b2-f2c1be06d3ce/

SH256 hash:

cf68f822581c977624b554e9669f1dacd3ea27da419ce7d922c4fd7159a37655

MD5 hash:

ef21daeeb39441e28b0cc86cc0e23235

SHA1 hash:

1297757d3382f98c8d391ee50d0dd892ab4f4440

Link:

https://www.unpac.me/results/18716411-3c10-4dc6-84b2-f2c1be06d3ce/

SH256 hash:

2839961bd9a9788fc8d20133e6123eaf2c27d61e7e50eba0e785e74339abc85c

MD5 hash:

1d404eefcb02b7a45812bb852d82e335

SHA1 hash:

1f75e957821394f601fe903de431951fd46040e2

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/18716411-3c10-4dc6-84b2-f2c1be06d3ce/

SH256 hash:

4f59ffd1f9e8b2088120692bae2d99ddf906cab5d98435baad7ac4073ca0fe81

MD5 hash:

6782ca1720c77e90ba84e9ab5ba4f07d

SHA1 hash:

79e819dde4a4b29ca3a221f89cf73f1fd818f1de

Detections:

Windows_Trojan_Formbook

Formbook

Link:

https://www.unpac.me/results/18716411-3c10-4dc6-84b2-f2c1be06d3ce/

Parent samples :

b225f4ef997754cc29f699ca3a8aa9aa1d39661d7c3dbc6f36a7c7a5bca235ab
92beab1ebf4cb74018b11571a5db867c2ec9d7bb0231a93a898cc3b7799558eb
acc906177a946e3e7fca9b9d962336e9e4d828297eb86761f610284f57fbf394
7a531101bc8522d52f45933945d6b8728ad7b7f3c9aaefd2d18742f8ec4000cb
bcfeb4ec31e731899a0ddd0a608aa7ecbfbdbf37f4ac3810b275ba6905a1969b
31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989
4d49933551f01cc730f63fd290ecb61f4bfa880a0660f0ec7363e148ef85645a
8bd60c5add862eb634b15fad4020a9afcf8ed6f523485665c80044f90bc8b305
07abbe06a2d17f142846d33bda215df5b05355148c781cb9ff1c8f233f534cbc
f42de693aaae005ec4dcf3514621f8573b422f3a3ad1bb1af370acc7c5cba233
4ef83ac7a3bdee1a742de8de749c5afa4747acc20f8937301dcba291d1ef83d7
d0d2ac5af6ecfdf27de6c45ab86d521294350c5a64942cd15bb5d9a1ae23b0f1
205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075
6f706398207b1fd3a00de5f859dc840cf8e100175fdabe260ebb96db5980f03c
acdcfb74712f171a6527ea14112eeb4bd482b7ae74f4e2990a946c8ccea8ad65
6be92b0d491f6d5d7f65e01a3336aac1155f091ad6def08b541e07b68eda3bb4
d672848afdf3f3a32d6de454a3408acd1d9cc0c338e65461e63330e9d26128ab
05d3f3857ab465a1886005e6d6138c84b8c19447b71d1781e8169e48c371c0a3
fab2b2eddd748ae7fcbc5a1d0c2e0a7f9c75214a114d9450ca41c85ea9e71a09
1e26f69f063b034aff856a4b9bb1680824e61ebf28867a36fa30e2b3e1727526
a779cf3623ccd0238d0b5d3f01dcc911e1538a1c0a656442234b4c3335453607
c991a3ee832bc707306f68c46786afc17de14163f8d3c757516bac9953ad6f3b
582c078327541d1459228aebf38c9471b78e3a2c03cb9c375622209221970709
77295a1c2d8172b2a2eb3f5f20a2880c168dd10f01830227e4f9ae6d4a5c9a19
d37c856c37f289af0a5cf37c5e2c9ab7b115d401d945426faadc6b48234dc2ba
a4c91afb043246fd8ab645f23ada21aca414339c38ceeefddf33cc8414f26f44
94d68efe46fa5e2e5789d0a3063b48cf486e73fbfab3b84f9203372688fd1286
c21657a9253431b91837bc2089fde8e909f780b5736dd44263e54765d95dfb9d
efc8dba0e301b455b4691c60bf363ce60bc0b44921a2018ce2c1a684df8d26b9

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/582c07832754/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_DIFF_Common_Strings_01 Create hunting rule
Author:	schmidtsz
Description:	Identify partial Agent Tesla strings

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 34f13ac5c8443fbe8575c210ae70d7cfac1fe4516db787e068f0d4df580f5e10

Formbook

exe 582c078327541d1459228aebf38c9471b78e3a2c03cb9c375622209221970709

(this sample)

Delivery method

Other

Dropped by

SHA256 34f13ac5c8443fbe8575c210ae70d7cfac1fe4516db787e068f0d4df580f5e10

Dropped by

MD5 c13052c813dc8d89c1170ba5614ddff9

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample