MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a37d37c6e25e6f8f3e181dbc9b6ed6f1e173cb4d7ed4c8bd914e8c7bef14078. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 25 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a37d37c6e25e6f8f3e181dbc9b6ed6f1e173cb4d7ed4c8bd914e8c7bef14078
SHA3-384 hash: d861e7872dcbe341024071b45958a40d6bfebd9c29c4178ce1d8e025e5d2bd6ccc91422ca9882453d31f1fee7c8c05d4
SHA1 hash: 797f218a150eaa1061f162c90a1feb588c2885ba
MD5 hash: ad2f2ae2bc107514560edf4a194809b2
humanhash: nebraska-quebec-london-muppet
File name:Purchase Order_21052024.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:720'904 bytes
First seen:2024-05-21 06:13:04 UTC
Last seen:2024-05-21 07:27:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:qXYifT+sc0vd3O2FMyjUVxRX3DntyzFk44+J5DvyIj/ku8bETDkR:qIiCsc013O2FMkUVxRHJyzZdykMDbyW
Threatray 11 similar samples on MalwareBazaar
TLSH T13BE423D271649723D36D7EB3F15802892B33F6A66D51C7DD1CDD20C486FABB225A0A13
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 00b6bae8a8aad602 (11 x AgentTesla, 2 x NanoCore, 2 x Formbook)
Reporter threatcat_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
348
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
5a37d37c6e25e6f8f3e181dbc9b6ed6f1e173cb4d7ed4c8bd914e8c7bef14078.exe
Verdict:
Malicious activity
Analysis date:
2024-05-21 06:15:45 UTC
Tags:
formbook xloader
Link:
https://app.any.run/tasks/96c98a6a-dff6-48c5-8b1e-f1cec4e3dd91

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.4726.4984.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Tags:
Encryption Generic Static Heur
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Launching a process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade overlay packed
Link:
https://www.filescan.io/uploads/664c3bb0eecf8de655e8e91e/reports/715f6a07-23a5-4892-8f7a-a0d46af4212f/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/5a37d37c6e25e6f8f3e181dbc9b6ed6f1e173cb4d7ed4c8bd914e8c7bef14078
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f0fa0831-beb3-42cf-8cd2-93e65ddcab93
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1444766
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses nslookup.exe to query domains
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1444766 Sample: Purchase Order_21052024.exe Startdate: 21/05/2024 Architecture: WINDOWS Score: 100 31 www.vpachurch.org.uk 2->31 33 www.shortput.top 2->33 35 22 other IPs or domains 2->35 41 Snort IDS alert for network traffic 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 Antivirus detection for URL or domain 2->45 47 8 other signatures 2->47 10 Purchase Order_21052024.exe 3 2->10         started        signatures3 process4 signatures5 57 Injects a PE file into a foreign processes 10->57 13 Purchase Order_21052024.exe 10->13         started        process6 signatures7 59 Maps a DLL or memory area into another process 13->59 16 SsQHccmRbXEMBeEUccRdH.exe 13->16 injected process8 dnsIp9 25 www.shortput.top 203.161.43.227, 49773, 49774, 49775 VNPT-AS-VNVNPTCorpVN Malaysia 16->25 27 betopfloor.com 108.179.192.228, 49785, 49786, 49787 UNIFIEDLAYER-AS-1US United States 16->27 29 11 other IPs or domains 16->29 37 Uses nslookup.exe to query domains 16->37 39 Found direct / indirect Syscall (likely to bypass EDR) 16->39 20 nslookup.exe 13 16->20         started        signatures10 process11 signatures12 49 Tries to steal Mail credentials (via file / registry access) 20->49 51 Tries to harvest and steal browser information (history, passwords, etc) 20->51 53 Modifies the context of a thread in another process (thread injection) 20->53 55 Maps a DLL or memory area into another process 20->55 23 firefox.exe 20->23         started        process13
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5a37d37c6e25e6f8f3e181dbc9b6ed6f1e173cb4d7ed4c8bd914e8c7bef14078
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a37d37c6e25e6f8f3e181dbc9b6ed6f1e173cb4d7ed4c8bd914e8c7bef14078/
Threat name:
ByteCode-MSIL.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2024-05-21 02:19:54 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=li35g7doextpr47bqhn4tnxnn4pbopfu27wuzc6zctumppxrib4a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0cb284abb63cf61b070bfa0a5250ff536f92907bbf5eec07070b9aeafa4ac2bd
Formbook
19b86526b9c8b33ee230bba95c8a02fc47db4d230933c3ebcb6888e0dd344f77
Formbook
37fd7b8035bd49b8dfad405a793428dda8cbf623de0133818756d05a1191d8b7
Formbook
4b98d799aec5026f2903adc659e69f7ccaeda9da2f71a4b43450f1204e090694
Formbook
5243b249b82fb33756ce0f6fd1daf1d556745e325d52a903903aa96a62436bd3
Formbook
bf1f882e2a1d0e35207cd7cab867bffe933e134e43ff317acf2db538bd4d7210
Formbook
d0b94b855d2f24add1edf6b3a6ecae24e4366f181a1ccd0bcd3b27e94de95bc0
Formbook
f7decb942c4d2f001d2f810978463780697403597ed4f5102a19c27edd649ce3
Formbook
+ 1 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240521-gzbyqsah9v/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2f3301c7-d370-4103-9eca-c9f3dc698191
Unpacked files
SH256 hash:
ea9eef71655ad92fb314ddf37633b88f23eebeffde6d547fe51c3fa662a9e9bc
MD5 hash:
f81207e10a74338541e8723a6a417124
SHA1 hash:
4e1e5af4c43fac8d1c52e3d8ad7879cdbc2492c1
Link:
https://www.unpac.me/results/cb455bb5-9162-4485-b46f-742111ecb292/
SH256 hash:
ebf469c46d04df3e52eb8690219f91dfcc6d0f29ec0c382155041f6da8537c39
MD5 hash:
8290a941e1129be99cf08f0e5ce5e1c1
SHA1 hash:
33161ef23a5ed447dc35a8b61b37705525dfdb9d
Link:
https://www.unpac.me/results/cb455bb5-9162-4485-b46f-742111ecb292/
SH256 hash:
0b7dcc18b0ef39734a24ca5923b02df82c670d08365fe376f2ed4ff9fcbc6303
MD5 hash:
0441cc0dacc6d821252e66a156b1d9bd
SHA1 hash:
df46cc702950a53a5de7b804d2076ef03f8ac6b4
Link:
https://www.unpac.me/results/cb455bb5-9162-4485-b46f-742111ecb292/
SH256 hash:
f540e8d603962027b3a1f8b86d035281bfbdd3a05a621ead255825bc2082632a
MD5 hash:
d172f59251b97b415b621d302e1be2b7
SHA1 hash:
b1534e603749c901b5ac185f20e281f6be7fa908
Link:
https://www.unpac.me/results/cb455bb5-9162-4485-b46f-742111ecb292/
SH256 hash:
d3c8a26561ecf0542c351ad0abafe6174a687b718422369125d956fb0a89d45a
MD5 hash:
da3d075a8ad1895a1f97b8d1b60798e3
SHA1 hash:
840c64fc11dd6fa0e4ce119c4d47e173a12bf695
Link:
https://www.unpac.me/results/cb455bb5-9162-4485-b46f-742111ecb292/
SH256 hash:
5a37d37c6e25e6f8f3e181dbc9b6ed6f1e173cb4d7ed4c8bd914e8c7bef14078
MD5 hash:
ad2f2ae2bc107514560edf4a194809b2
SHA1 hash:
797f218a150eaa1061f162c90a1feb588c2885ba
Detections:
INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Link:
https://www.unpac.me/results/cb455bb5-9162-4485-b46f-742111ecb292/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5a37d37c6e25/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5a37d37c6e25e6f8f3e181dbc9b6ed6f1e173cb4d7ed4c8bd914e8c7bef14078

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Formbook
Create hunting rule
Author:kevoreilly
Description:Formbook Payload
Rule name:INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 5a37d37c6e25e6f8f3e181dbc9b6ed6f1e173cb4d7ed4c8bd914e8c7bef14078

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments