MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61c8261eea2ec84dac43c11db5b13579cde940032a0b5ea9a6b1f58b93b1582a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments 1

SHA256 hash:	61c8261eea2ec84dac43c11db5b13579cde940032a0b5ea9a6b1f58b93b1582a
SHA3-384 hash:	63923008e84a010888043ce5e8857a9d4400b88865ed480c6acf7406b15fb93ff647b321d923dffe0fd373dfd8ef7aba
SHA1 hash:	9c9abd13fbc6bb81d4fa17ffa7c2be6dba81c5f5
MD5 hash:	8e285d434922e63d303da4e3639fe13c
humanhash:	spaghetti-lithium-pluto-echo
File name:	8e285d434922e63d303da4e3639fe13c
Download:	download sample
Signature	Formbook Create hunting rule
File size:	536'064 bytes
First seen:	2023-08-02 18:41:22 UTC
Last seen:	2023-08-21 02:27:59 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	12288:Ut2vNqiSAH/EZ6w7Ns7fZdQrQY1jm5Uy8+xYRi/DWTbAr8dBXim7PHT:UtCNuE/hwxcfZsn7y8+3SAgjig/T
Threatray	36 similar samples on MalwareBazaar
TLSH	T13AB412242B70C3E6F2515E3580D911A368FCBA11AB38B3B7B2456AFB84D223667CD553
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	zbetcheckin
Tags:	64 exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

352

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

00067-1.doc

Verdict:

Malicious activity

Analysis date:

2023-08-02 17:48:50 UTC

Tags:

exploit cve-2017-11882 loader

Link:

https://app.any.run/tasks/74ad5005-346e-42f2-909a-7641b7524a5b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/439923/

Detection(s):

SecuriteInfo.com.Variant.MSILHeracles.99736.15735.19711.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed packed

Link:

https://www.filescan.io/uploads/64caa37d539838c2be51ea87/reports/d5a1bf5c-4ffc-4837-9163-5b010b5bbed1/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/61c8261eea2ec84dac43c11db5b13579cde940032a0b5ea9a6b1f58b93b1582a

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/c3b9d428-6bfc-4da4-b4c6-b425ece8bf88

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1284662

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

C2 URLs / IPs found in malware configuration

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Costura Assembly Loader

Yara detected FormBook

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/61c8261eea2ec84dac43c11db5b13579cde940032a0b5ea9a6b1f58b93b1582a/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2023-08-02 18:17:53 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

12 of 24 (50.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mhecmhxkf3ee3lcdyeo3lmjvphg6sqadfifv5kngwh2yxe5rlava._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/230802-xcbx8aac6x/

Behaviour

Suspicious use of AdjustPrivilegeToken

Unpacked files

SH256 hash:

61c8261eea2ec84dac43c11db5b13579cde940032a0b5ea9a6b1f58b93b1582a

MD5 hash:

8e285d434922e63d303da4e3639fe13c

SHA1 hash:

9c9abd13fbc6bb81d4fa17ffa7c2be6dba81c5f5

Link:

https://www.unpac.me/results/9490b8d5-ce90-42c8-9099-2985d80e8242/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/61c8261eea2ec84dac43c11db5b13579cde940032a0b5ea9a6b1f58b93b1582a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.