MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 688ba75525fea2de02b06a99c4698724cb865d8e0f195d1b7b436aba7d942541. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	688ba75525fea2de02b06a99c4698724cb865d8e0f195d1b7b436aba7d942541
SHA3-384 hash:	3ab849b4ddbe50e2a4f8eac9ec1ca0afdc565100f6be06f3a93ef527fa9a40eaa361811704b2cf3f0b5103c13784fb57
SHA1 hash:	d9c03b376704e43ac5ce983a15b81a5010129aba
MD5 hash:	df8b6cc1f871db34157a3d23f85450cd
humanhash:	queen-freddie-solar-ink
File name:	CAMSCANNER PAYMENT DETAILS.exe
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	328'192 bytes
First seen:	2023-05-22 14:05:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	91e52b5b5b8df9c17be98b9e4559a03d (1 x Amadey, 1 x RedLineStealer, 1 x Formbook)
ssdeep	3072:NuuVQvdgLdXX4TZtFxV6qLaKrxV+SjCPGCl4tk3xMIlx29vSRqGPalkzWcB1fqfF:x+m4rFZCSL44tk3Wy2o1ylWhfCOCDJ
Threatray	2'872 similar samples on MalwareBazaar
TLSH	T1E964E12176C0C071E17306304AB1C6B68B3BB86187B259CF6BE1567A1F763D2DA34757
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	74dc982ca49c9c62 (1 x Formbook)
Reporter	lowmal3
Tags:	exe FormBook

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

287

Origin country :

DE

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

CAMSCANNER PAYMENT DETAILS.exe

Verdict:

No threats detected

Analysis date:

2023-05-22 14:08:45 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b8283b87-ad56-4b8c-93d3-95ba5b9f9179

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

Sanesecurity.Malware.29323.BadIN.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Сreating synchronization primitives

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/87446/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

CheckCmdLine

EvasionGetTickCount

EvasionQueryPerformanceCounter

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

greyware overlay packed

Link:

https://www.filescan.io/uploads/646b7707642a967932809705/reports/3c4281c9-7dc8-4943-9bf9-ea922c0f6f49/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/688ba75525fea2de02b06a99c4698724cb865d8e0f195d1b7b436aba7d942541

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Formbook

Malware family:

Formbook

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cc604cc2-3355-4bf8-b436-abe3baa0608a

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

evad.troj

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1239712

Signature

Detected unpacking (changes PE section rights)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample has a suspicious name (potential lure to open the executable)

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/688ba75525fea2de02b06a99c4698724cb865d8e0f195d1b7b436aba7d942541/

ReversingLabs TitaniumCloud Win32.Trojan.Smokeloader

Threat name:

Win32.Trojan.Smokeloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-22 14:06:04 UTC

File Type:

PE (Exe)

Extracted files:

8

AV detection:

16 of 24 (66.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ncf2ovjf72rn4avqnkm4i2mhetfymxmob4mv2g33invlu7muevaq._file

Threatray formbook

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

Similar samples:

17483ba2526d9ba490c29dc88e5c1a066b0c26f22243e02d312542a53f292393

Formbook

6088e5794bbad98ae26121ec1c195a03b0b575e602a4a2bc2c8e299647186abd

Formbook

73ebb7a09698155fa4a55057e36c5ffda58b30940670955cb7e2ecff5a348b15

Formbook

9f44c58001149776520aeff671ff0888b3af00f1f0188f768ed21595fa30f81c

Formbook

b15e539ba1801af269c976fa743708a0fc474fcdf6ba3a7433a08dfbf9eb1425

Formbook

cd5a3db769491e5e9b19fe8f2703456f82dbd128babacf54ac1c494587665f72

Formbook

e904274bd2e5d919c63c6db8c82f908abc10d65fdba772596e2953ab708b1726

Formbook

ee358a011cc5cb7f997685a47255bd3ebe7d1632c5e09099f5f70767c5061290

Formbook

f51bdb3c0026435904048abffb411be8b57143de59d0e66a3e2dfa3f2e5692ad

Formbook

fb4c3c803b69b2823f0bb584ef77da38f17eaf18184058249b6dd7664234cb53

Formbook

+ 2'862 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230522-redlyagh63/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Checks computer location settings

UnpacMe win_formbook_w0 win_formbook_auto win_formbook_g0

Unpacked files

SH256 hash:

34b16d9aa34a06209411186e956239c1877e490dd9b6306aca2b8537066b63d9

MD5 hash:

26afa958b72d27bea25fdefb55e8731f

SHA1 hash:

acd603736e0b670ca198059d61c8cd3884aa5c56

Detections:

win_formbook_w0

Alert

Create hunting rule

win_formbook_auto

Alert

Create hunting rule

win_formbook_g0

Alert

Create hunting rule

Link:

https://www.unpac.me/results/1e62e90d-2627-4116-adca-36f24c14376d/

Parent samples :

ee358a011cc5cb7f997685a47255bd3ebe7d1632c5e09099f5f70767c5061290
688ba75525fea2de02b06a99c4698724cb865d8e0f195d1b7b436aba7d942541
29fc28e7fe1f87451e12b9a12800c80c56a3e88d0934ba5090d7e585b32fac30
f6b74362f5c3be4483dfeea056310801a4694ae9f8ed0f42c2ac99c86c752880
44bea404825374b13944297270be55bb2e18c7b95b2c7051800e4fb2d5fc2dbc
a15e826b6d0b658c57976684b1d2d20459ac7e5013f5cdeb12bfa2c8ff7359c8
4a4e3d020a90d81969f2458b4de891ac4cf1bc2b4e0c15eb42e0a0a26a3b66f3
52cde2b88aa65fd327813294d67dc3cc10ffaa1774acc0c7a5d40de397de2871

SH256 hash:

0abcaa4dd531ab1cd2b6eb8dc6b017da8c25f8168f647cfc2d5bdf6f792e1559

MD5 hash:

d62e812dd0ed624a487f87ee35c37089

SHA1 hash:

acf85b6fd0d54f81a5cb647d734cf3fe01aebc3d

Link:

https://www.unpac.me/results/1e62e90d-2627-4116-adca-36f24c14376d/

SH256 hash:

688ba75525fea2de02b06a99c4698724cb865d8e0f195d1b7b436aba7d942541

MD5 hash:

df8b6cc1f871db34157a3d23f85450cd

SHA1 hash:

d9c03b376704e43ac5ce983a15b81a5010129aba

Link:

https://www.unpac.me/results/1e62e90d-2627-4116-adca-36f24c14376d/

VMRay XLoader

Malware family:

XLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/688ba75525fe/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/688ba75525fea2de02b06a99c4698724cb865d8e0f195d1b7b436aba7d942541