MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 6f1acd309fb5ffdbfe2e1ca42dd060ed57e2107767f945f47cbbd71a5a189062. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 11
| SHA256 hash: | 6f1acd309fb5ffdbfe2e1ca42dd060ed57e2107767f945f47cbbd71a5a189062 |
|---|---|
| SHA3-384 hash: | f63712bec50050eddc8a5466b75a7a996c3c5c42377e6cd14a142114e559ec2699fc4bac39d211be0354394f0f8ed31b |
| SHA1 hash: | de41f2119677b21f5b118515ed32fd4d24c98304 |
| MD5 hash: | 8cdaa8773fd3e08dd15b596180872091 |
| humanhash: | massachusetts-blue-yellow-robert |
| File name: | quotation request.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 774'656 bytes |
| First seen: | 2023-06-20 06:27:57 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 12288:Ab903Y6auPM7q6bpw4dcZda/igJ4aaZvZ/xMmAMYm8jgO/x4p+r0t+Qy:Ab903Yrzu4CZdOexD/+mAU8jB/wuA |
| Threatray | 1'541 similar samples on MalwareBazaar |
| TLSH | T16AF412285A96452BC12B0B799860E770523CAECE7622E7EF0CCB7CC77E56BCD053511A |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 2b2555676501612b (15 x AgentTesla, 3 x Loki, 2 x Neshta) |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
255
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
quotation request.exe
Verdict:
No threats detected
Analysis date:
2023-06-20 06:48:34 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
formbook packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Signature
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 1'531 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
596fbee298702b05e8e9d0ef5ff52ae587f2aad12363d10291e34f52ed17f894
MD5 hash:
e1a21c1e9a97d9e1dd4564783ca28756
SHA1 hash:
92bf63acae5f224ec94660e191aa439a1de86220
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
23aad32f6bb90ff654c677b7a6208aaa6a353fc6dbe7b1f377fcc716df41a143
MD5 hash:
aad0f1e8041a9efba869bdb369dc1647
SHA1 hash:
2b2db700f16d0e9ef6a5bcab13b72a80234d8285
SH256 hash:
bf30f7032a6e2fdd6a872718de569645dda2c9e734a4f90a77e5af9a58d75812
MD5 hash:
29432c0db5445ce74b8a1042234187af
SHA1 hash:
fdc1bce5c868fbaed48ff27b3cc73b752bc66e75
SH256 hash:
d6d62867580dc9d28d4e47aa4b479916e7c1167f0700a56ae0da9d2d6f311308
MD5 hash:
6b9c9191a8e10ade40d8ab7eb5caeb92
SHA1 hash:
7fc053f77f020c18fea92701b171f049159a08d9
SH256 hash:
8e22b93c04406cc1f47e2ee1f50f4dd5b72cbc7ec848b633036cd7411a8d3389
MD5 hash:
d7dbbb9b7c47c50b75d3141a1513ce6e
SHA1 hash:
7aa9f734ec6e046cb3ef73e520305a182b426d2a
SH256 hash:
f7dfaa76c99482ebc80c36a7cc34acee191eb0ec3eefd0139c925e0550f63f98
MD5 hash:
d287a890c553f774d06b10566d87dbf2
SHA1 hash:
04bd06bab09ec9484342395b56105e6450ee2795
SH256 hash:
6f1acd309fb5ffdbfe2e1ca42dd060ed57e2107767f945f47cbbd71a5a189062
MD5 hash:
8cdaa8773fd3e08dd15b596180872091
SHA1 hash:
de41f2119677b21f5b118515ed32fd4d24c98304
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.