MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 65ae1550333eb53329dab317b8f238dc060368d982b30a734ebdf0604d61a06c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 11
| SHA256 hash: | 65ae1550333eb53329dab317b8f238dc060368d982b30a734ebdf0604d61a06c |
|---|---|
| SHA3-384 hash: | 08242a42885161c300409e43554b6d8c29ec9d04e92c404a27b334ce5152b51169a5b0263a966b84d0508fbdfecada99 |
| SHA1 hash: | 9de77b7d7f25881781add6a24d8255c921575872 |
| MD5 hash: | bc5990cf2de459a2dbaaded72599b152 |
| humanhash: | angel-wolfram-yankee-march |
| File name: | SecuriteInfo.com.Win32.PWSX-gen.20725.32698 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 986'112 bytes |
| First seen: | 2023-03-17 06:28:02 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 24576:6jjkj+caRJ+SSx0hLaAe2lmSiWQc2/CiM:6jjkSPQG2AVSCn |
| Threatray | 2'239 similar samples on MalwareBazaar |
| TLSH | T17E25DF68B72DFB30C6FA53B9ACF124D643E39C5A5625E2485CDD74EA3732B61840384B |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | f06996d6cad20d52 (3 x RemcosRAT, 3 x Formbook) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.20725.32698
Verdict:
Malicious activity
Analysis date:
2023-03-17 06:29:16 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj
Score:
68 / 100
Signature
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Pwsx
Status:
Malicious
First seen:
2023-03-17 04:37:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
35
AV detection:
15 of 39 (38.46%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'229 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
dd4b02f5f3ff857c5de6c4a84cfeac5b27f091f20baf2dd3bcc77616f0239f44
MD5 hash:
1096693fba6c51bd1f4487c0323faa80
SHA1 hash:
fcaf2530a525b85a0d7ce1db2dc72e34b43625e9
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
4a19856dbcfd1ed73ea288396c0f40e85824b5deda8605031362d6c5f298bfca
MD5 hash:
3176c95d2dc664ce6effc2085c360560
SHA1 hash:
c144ef31f3e0376b847c1f599311a56068570e11
SH256 hash:
06bc81909679664c7d1870991377b1128ca30c9e814a9bab63b7fc1f7a93361b
MD5 hash:
76888413adb9e6f2a17e11cb4890f24f
SHA1 hash:
ae697ac68732832409c8cf6d02cc1c167fa93bc8
SH256 hash:
d06df7395d561e198f9b7c5481567116ff2e4c2e84437c018d2a2c8ea6c4ca37
MD5 hash:
0fb6061f7d37424fb9e6d0e76b019c19
SHA1 hash:
98a64bf7b459f032d6ec5793003bf61b5ae1dd74
SH256 hash:
c93cc8ee3db7870240180ec3843e1c99caf29a70dd2f141dc697704575b98891
MD5 hash:
10b9de01b152e2a5709df36584905828
SHA1 hash:
852e1095a6e7a1706b20577c4ca49bf5bd6cc107
SH256 hash:
9e5fcea2d9f00b7dd2e6c8c46f09e86d1e5bbbdd8096f57dc374b9b14ec9a7cf
MD5 hash:
ec1ad2ead9a77e4a0f3655671d319805
SHA1 hash:
065fc764be15568704d1e07d1b477ba4671a8f14
SH256 hash:
65ae1550333eb53329dab317b8f238dc060368d982b30a734ebdf0604d61a06c
MD5 hash:
bc5990cf2de459a2dbaaded72599b152
SHA1 hash:
9de77b7d7f25881781add6a24d8255c921575872
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.