MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 6de3ca2658af9f752d06492509b21dbe3862fc018270f56d5a2894cb6e5a1e7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 12
| SHA256 hash: | 6de3ca2658af9f752d06492509b21dbe3862fc018270f56d5a2894cb6e5a1e7a |
|---|---|
| SHA3-384 hash: | c7038a4ab1349f90215195e4b7eb749ae8f57c5bbdf150e2c584a1cdabe9fe5e6459de26a83fd1652fc53e7676fc7817 |
| SHA1 hash: | 028c526c37fae3dde89a1927c05229e4f9cd6abc |
| MD5 hash: | 1d53cc6f9a980bd702fbde5d8d39eeb9 |
| humanhash: | magazine-hotel-sodium-louisiana |
| File name: | SecuriteInfo.com.Win32.PWSX-gen.4432.13418 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 649'728 bytes |
| First seen: | 2023-12-04 06:32:42 UTC |
| Last seen: | 2023-12-05 08:18:02 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'644 x Formbook, 12'245 x SnakeKeylogger) |
| ssdeep | 12288:Y45+po2QiHBU1So/2q1eC0lvI0VoC0qgqK6AlCD3DsQClUTcmCq+uRZxN5K:b+pJJhfK2q1ePLWqKRl23Za8RzNM |
| Threatray | 464 similar samples on MalwareBazaar |
| TLSH | T1D4D423CA72C8EF21EC3BABBBB885255107F9B6029271FF2A36D511DC6556B060EC1713 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | 23ccccfc3c6c2c17 (12 x Formbook, 8 x AgentTesla, 5 x SnakeKeylogger) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
312
Origin country :
FRVendor Threat Intelligence
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-12-04 05:10:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
19 of 37 (51.35%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 454 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
96adebe2d3724b09c5f8d594729bbf9b084d9b6dff3398c5e1c7d79d0ca642e3
MD5 hash:
66177a12d0bc968626c1716133a08e46
SHA1 hash:
df395156d246854650801b46607b4a1b2ba47721
SH256 hash:
a0f01eaf0772e8a22deec7deaffe23c78790261a8e917005e7796e12f4b89b6d
MD5 hash:
2d194f56ed6fd1e15d977f873b63df83
SHA1 hash:
adf44b215e43477d8e70b942c528a83df3837c7b
SH256 hash:
c9436a6732bce14c02356f1d6c6d464ab5616db7a7078845f941095da32ae29b
MD5 hash:
2b284421baecdf965275a16dd1dfe01b
SHA1 hash:
a417d5beca52f712174597ca83413d6e05ab7b79
SH256 hash:
ad4132730b342f6419da0bf33f42a7b4c875bbde8d8762a01a5d19b0929bf4d3
MD5 hash:
901b777febd2041ffde0d08498a32276
SHA1 hash:
55710d0d0331b62a2f475df10f0aeb47878cacd7
SH256 hash:
c34dfbc328de247d25d670c3b7853f1dddd2ec2607d5dbb0480743b45a15ea64
MD5 hash:
85b87384830444e6ab86a4a692ce96cc
SHA1 hash:
0d7d4614cf31d27e68ebf48e76fb1d308cc08152
SH256 hash:
6de3ca2658af9f752d06492509b21dbe3862fc018270f56d5a2894cb6e5a1e7a
MD5 hash:
1d53cc6f9a980bd702fbde5d8d39eeb9
SHA1 hash:
028c526c37fae3dde89a1927c05229e4f9cd6abc
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DebuggerCheck__GlobalFlags |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Active |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Thread |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | Formbook |
|---|---|
| Author: | kevoreilly |
| Description: | Formbook Payload |
| Rule name: | maldoc_find_kernel32_base_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | maldoc_getEIP_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Windows_Trojan_Formbook |
|---|---|
| Author: | @malgamy12 |
| Rule name: | Windows_Trojan_Formbook_1112e116 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_formbook_w0 |
|---|---|
| Author: | @malgamy12 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.