MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60d3a6a96815b235c93bb340cd338fbdf8a80a3dee023a37503550eb953f5e78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60d3a6a96815b235c93bb340cd338fbdf8a80a3dee023a37503550eb953f5e78
SHA3-384 hash: a202f96681eb022b6f87596e9096ec1cc16bac6724fef500191910ca0d0317c485ab30b7c58a747a2f8e85790e24695d
SHA1 hash: 9cce2126c14ba39a57e21479b07ad98747219a1f
MD5 hash: 4f817ca23420dd08a3f8bc8bea2e7dc9
humanhash: fish-sodium-massachusetts-gee
File name:document.xll
Download: download sample
Signature Formbook
Create hunting rule
File size:3'584 bytes
First seen:2021-06-30 20:01:11 UTC
Last seen:2021-06-30 20:54:29 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash efe4e83a803acf4884cbe38e0de198b8 (1 x OskiStealer, 1 x Formbook)
ssdeep 48:ZvtkwMY0mAYzFlqw99v9tmilde9xE2vrBLz6:Z1pj0e+w99bQjXTZ6
Threatray 6'231 similar samples on MalwareBazaar
TLSH 0A7152226BE4C6E1D25C3A7109834B1DD96DF634C71387223B90A92F2D6B3A4642E756
Reporter Anonymous
Tags:dll FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/168983/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader.origin.325.952.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9ca9d373-c33f-47a6-bea4-d725e6a3a417
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/810209
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Document exploit detected (process start blacklist hit)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office process drops PE file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: MS Office Product Spawning Exe in User Dir
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 442618 Sample: document.xll Startdate: 30/06/2021 Architecture: WINDOWS Score: 100 53 Found malware configuration 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 Antivirus / Scanner detection for submitted sample 2->57 59 11 other signatures 2->59 11 EXCEL.EXE 22 26 2->11         started        process3 dnsIp4 43 212.192.241.203, 49723, 80 RAPMSB-ASRU Russian Federation 11->43 33 C:\Users\user\AppData\Roaming\kyhoiuhjo.exe, PE32 11->33 dropped 35 C:\Users\user\AppData\Local\...\sm[1].exe, PE32 11->35 dropped 15 kyhoiuhjo.exe 4 11->15         started        file5 process6 file7 37 C:\Users\user\AppData\Local\...\kyhoiuhjo.exe, PE32 15->37 dropped 45 Multi AV Scanner detection for dropped file 15->45 47 Machine Learning detection for dropped file 15->47 49 Writes to foreign memory regions 15->49 51 Injects a PE file into a foreign processes 15->51 19 kyhoiuhjo.exe 15->19         started        signatures8 process9 signatures10 61 Multi AV Scanner detection for dropped file 19->61 63 Machine Learning detection for dropped file 19->63 65 Modifies the context of a thread in another process (thread injection) 19->65 67 4 other signatures 19->67 22 explorer.exe 19->22 injected process11 dnsIp12 39 www.darwinesssay.com 158.69.24.60, 49742, 80 OVHFR Canada 22->39 41 www.hack-cloud.icu 22->41 69 System process connects to network (likely due to code injection or exploit) 22->69 26 mstsc.exe 22->26         started        signatures13 process14 signatures15 71 Modifies the context of a thread in another process (thread injection) 26->71 73 Maps a DLL or memory area into another process 26->73 75 Tries to detect virtualization through RDTSC time measurements 26->75 29 cmd.exe 1 26->29         started        process16 process17 31 conhost.exe 29->31         started       
Detection:
cve-2017-11882-shellcode
Create hunting rule
Link:
https://mwdb.cert.pl/sample/60d3a6a96815b235c93bb340cd338fbdf8a80a3dee023a37503550eb953f5e78/
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2021-06-30 20:02:16 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
046bf8a6c9bc47b10b80a2ca83289714a931b5d10d864e02d2e20fdc09301108
Formbook
09f19a43e9a0b736e9fcd33359267340b91a2ccc376c8cda72fac9754c1493c0
Formbook
4fe5115259b2c032f03275273349549ab896959c818d771a4ad755ce64866379
Formbook
5aa64b3eef03b9c837e37102be20cb4f537c524b2a2531bf1bf6dd6a02461d7e
Formbook
851ee4f67cc28e3634b0062d77f62222d026c4e9674a894bcdd5b6c6e6bda376
Formbook
94ad76a6e3bf3b13f3703814b4eb47bdf0c64a8aac9cf74d585d1b1bc84962e3
Formbook
a2cdf452f83aa86c0f3ade321cfc00a9ed3671082372081a67cad84a26492051
Formbook
b3c5b3cf581d15fcbacf67b4bdba199bfe7089704875746109b3206eb07b99e2
Formbook
d0116b0ea676a655b1d55a2b7a79fb2585c1d04803e9d1d6f9cd1da15f789138
Formbook
e68f17cfe87742103150ca9abd6cc16581caa6e0e0243d03fae2c89c2609c974
Formbook
+ 6'221 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210630-q8aej9dmg6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.inspiredpractice.net/csls/
Unpacked files
SH256 hash:
60d3a6a96815b235c93bb340cd338fbdf8a80a3dee023a37503550eb953f5e78
MD5 hash:
4f817ca23420dd08a3f8bc8bea2e7dc9
SHA1 hash:
9cce2126c14ba39a57e21479b07ad98747219a1f
Link:
https://www.unpac.me/results/d9c7106a-e5d5-4a0e-8e54-9562487279c2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/60d3a6a96815b235c93bb340cd338fbdf8a80a3dee023a37503550eb953f5e78

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/168983/

Comments