MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5adbcb5406936cc182300072b9306adda1eb3cf1aac9e87ad211515d19450bd9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | 5adbcb5406936cc182300072b9306adda1eb3cf1aac9e87ad211515d19450bd9 |
|---|---|
| SHA3-384 hash: | 090d99ed3bca7be5d69540079d81bb02629736d637c3450e8096d0d30a0ba911a8e2a48d3bb5803ed6ad250dc48bd6a0 |
| SHA1 hash: | f359837714b034a3424c8b809750893b243f1bd3 |
| MD5 hash: | 03e83bc9a506a966f1d8293424e963f8 |
| humanhash: | chicken-zebra-lamp-failed |
| File name: | DHL Invoice Details_pdf.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 829'440 bytes |
| First seen: | 2023-06-12 11:14:52 UTC |
| Last seen: | 2023-06-12 11:37:56 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:IG0biRoSErVxIE5b/lmEt/2zFByuUtb5nUq1Unzj5di4:3y4oRrjIwb/8IOREb5nUq1UzNdP |
| Threatray | 679 similar samples on MalwareBazaar |
| TLSH | T1B905125D06FB421ED94A3FBC1C500671E3FA86A67537D71B9EABA8D8DF2270805906C3 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | 71cc8cb2aa96d471 (13 x AgentTesla, 5 x Formbook, 2 x Loki) |
| Reporter |  abuse_ch |
| Tags: | DHL exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
263
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL Invoice Details_pdf.exe
Verdict:
No threats detected
Analysis date:
2023-06-12 11:15:35 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Trojan.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
64 / 100
Signature
.NET source code contains potential unpacker
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Leonem
Status:
Malicious
First seen:
2023-06-09 13:16:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
16 of 24 (66.67%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 669 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
bbc058ebc76ff4eb2e474f7bde49699ebf61366c50c2b9d5a2d07779e6b57267
MD5 hash:
bc1d851b16242463e1d856ba1d745974
SHA1 hash:
c38713c2f5279f76c604742ec66d0ed56b1978d1
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
6119d41edc4faddea3e5fb6876a0c6de99b59f01f7082946c0b823adeadb916c
MD5 hash:
ee8a504b4d6f8178951a8fa36744d668
SHA1 hash:
47faae8a48f7925e1c25e0c5e38d0d7a8df110db
SH256 hash:
88b2f82123066a01c4c47bed8951fdf53f72a89af9580a200d382616539f09ca
MD5 hash:
680f2970dda6a49358954e32a7a79119
SHA1 hash:
e92bf5b1a0f5d93feab9103903e6ddd424527b3b
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
SH256 hash:
cad9d5158bd4148003f9393e3b89ea98951360112337f191af3fc7ed9d9fac34
MD5 hash:
cebb2b71aadd6adf6c4b077193e0522b
SHA1 hash:
b705fe3184e6e0a48cf7e30dbe9d1bf317e83a45
SH256 hash:
199434c1ba0249c5713308ee793f533b1253422036ecd9276759e6cbd8b68395
MD5 hash:
609cb72bdbedff2791417f4fdd7f9b66
SHA1 hash:
7e2d66960fa5643df966fcc056c1210d6d4e3e0c
SH256 hash:
5adbcb5406936cc182300072b9306adda1eb3cf1aac9e87ad211515d19450bd9
MD5 hash:
03e83bc9a506a966f1d8293424e963f8
SHA1 hash:
f359837714b034a3424c8b809750893b243f1bd3
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.