MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6247b730b81fb512b45eadaacfe49037850b6c383e55549565176b9e6e32be8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 8

Intelligence 8 IOCs YARA 12 File information Comments

SHA256 hash:	6247b730b81fb512b45eadaacfe49037850b6c383e55549565176b9e6e32be8c
SHA3-384 hash:	960d6e68d5e2c9da1203c6d4139cf55189db148b0bd31547ef488780455c625bfaff6db3a138b8e707cc84aa561e173c
SHA1 hash:	2b861671db926b2416a52d22426a547040b930d4
MD5 hash:	5cc636607ab0612a6f42446503c79305
humanhash:	ohio-idaho-kentucky-utah
File name:	M.V. BENEDICTO_PDF.zip
Download:	download sample
Signature	Formbook Create hunting rule
File size:	787'903 bytes
First seen:	2024-12-02 23:59:41 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:Or4Oup4/URzaCRbCPMQ8WM2LKSJMG6ZVDesCwM43WIyX8MkRA7Pm2xPHyr:WCp4/U0ybCLKSmn7C43UtMA7Pm2xHyr
TLSH	T126F423587C99B93461B5D2A362DDFABDB448E830973FCBC8B8BAE1D075792348581D30
Magika	zip
Reporter	mamrmu
Tags:	zip

Intelligence

File Origin

# of uploads :

# of downloads :

691

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	M.V. BENEDICTO_PDF.exe
File size:	1'214'976 bytes
SHA256 hash:	7028738c70b53f22408c940ca3fd4962cae12352a5edc5a22b39f53fbba3e72d
MD5 hash:	ffc46b1f45854621d4ac030b97da2b09
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Zip_badexts14.UNOFFICIAL

SecuriteInfo.com.BehavesLike.Win32.Generic.vh.UNOFFICIAL

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=674e4b7d04c232bff3b62f88

Tags:

autoit emotet

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/6247b730b81fb512b45eadaacfe49037850b6c383e55549565176b9e6e32be8c/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug autoit compiled-script evasive explorer fingerprint fingerprint hacktool keylogger lolbin masquerade microsoft_visual_cc mmc monero packed packed packer_detected

Link:

https://www.filescan.io/uploads/674e4a03bf62015002e706ae/reports/90250d79-50b5-43f4-a221-92a3d89e49b6/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6247b730b81fb512b45eadaacfe49037850b6c383e55549565176b9e6e32be8c

Score:

100%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	SUSP_Imphash_Mar23_3 Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:	Internal Research

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)