MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 736fb3f0900c299f259ba08b2ac7c63b3b5aa08b40935d2a8b9c32e5056b81fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 736fb3f0900c299f259ba08b2ac7c63b3b5aa08b40935d2a8b9c32e5056b81fa
SHA3-384 hash: 053d13b8979594ede8fe2f2baa3618550641d5ade398b155b7539b51392d4b9d8c9a9d241dd0e938d2e68a1898abeb38
SHA1 hash: 37b0dcca5b96f4acb1a7dda154d70e39b2fc8bc5
MD5 hash: 3cb5a88313d51e8d3c43d4ded0a6d759
humanhash: lake-maryland-video-stream
File name:from-iso_DHL_119040 RECEIPT DOCUMENT,PDF.EXE
Download: download sample
Signature Formbook
Create hunting rule
File size:266'191 bytes
First seen:2022-03-28 07:49:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 6144:LGiyw9Q4D/8GFK++XshNX3l63nRS0s+jkzvfSLd:Owxj8F++sTA3Q2kEd
Threatray 14'543 similar samples on MalwareBazaar
TLSH T14244F187F585285EF4EF833B36E65E39FAF5519A05021E1243B53FA5BF212814BC0B4A
File icon (PE):PE icon
dhash icon 94327292e8ccb4c8 (5 x Formbook, 3 x AgentTesla, 2 x RemcosRAT)
Reporter abuse_ch
Tags:DHL exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
203
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/258470/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.11176.22921.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Сreating synchronization primitives
Launching a process
Launching cmd.exe command interpreter
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Searching for synchronization primitives
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/624168b19253b276b78d4c87/reports/b30f208c-0f6b-4202-bc31-59db462c0e3c/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cb1f7965-210d-47bb-ad79-2d9d14ac2512
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/965591
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Executable has a suspicious name (potential lure to open the executable)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 598071 Sample: from-iso_DHL_119040 RECEIPT... Startdate: 28/03/2022 Architecture: WINDOWS Score: 100 34 www.produtossaudaveisonline.com 2->34 36 www.laibanjin.com 2->36 38 produtossaudaveisonline.com 2->38 54 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->54 56 Multi AV Scanner detection for domain / URL 2->56 58 Found malware configuration 2->58 60 8 other signatures 2->60 12 from-iso_DHL_119040 RECEIPT DOCUMENT,PDF.EXE 18 2->12         started        signatures3 process4 file5 32 C:\Users\user\AppData\...\osthhplxyb.exe, PE32 12->32 dropped 15 osthhplxyb.exe 12->15         started        process6 signatures7 70 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 15->70 72 Tries to detect virtualization through RDTSC time measurements 15->72 74 Injects a PE file into a foreign processes 15->74 18 osthhplxyb.exe 15->18         started        process8 signatures9 46 Modifies the context of a thread in another process (thread injection) 18->46 48 Maps a DLL or memory area into another process 18->48 50 Sample uses process hollowing technique 18->50 52 Queues an APC in another process (thread injection) 18->52 21 explorer.exe 18->21 injected process10 dnsIp11 40 www.ref3drive.art 202.165.66.108, 49703, 80 VPIS-APVADSManagedBusinessInternetServiceProviderMY Australia 21->40 42 www.laibanjin.com 104.252.184.159, 80 EGIHOSTINGUS United States 21->42 44 2 other IPs or domains 21->44 62 System process connects to network (likely due to code injection or exploit) 21->62 25 chkdsk.exe 21->25         started        signatures12 process13 signatures14 64 Modifies the context of a thread in another process (thread injection) 25->64 66 Maps a DLL or memory area into another process 25->66 68 Tries to detect virtualization through RDTSC time measurements 25->68 28 cmd.exe 1 25->28         started        process15 process16 30 conhost.exe 28->30         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/736fb3f0900c299f259ba08b2ac7c63b3b5aa08b40935d2a8b9c32e5056b81fa/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2022-03-28 10:59:22 UTC
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=onx3h4eqbquz6jm3ucfsvr6ghm5vvielicjv2kultqzokbllqh5a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0da36b7f7e4b44b640ab5769532fdd7599032ca2b1d6b57807ba48ad1fa76780
Formbook
2a4415721925c12ce8a80719697ffbda5daf88fe34804b0549bc5d5605790cdb
Formbook
5f8d69976e4d3c9b6508cd376dcab4971a605d8d1122952ad604f7b48d2ef1e1
Formbook
78626de6d56a42e31638f24a044d6082282e6f8d2d66ea2f5d4e65fe816a92ee
Formbook
786698eab83f77c1fdc3d37daf49966befe788b0e85167083726354225176d1f
Formbook
8ddf9843afa2f66549fe02a8ddc9811c2ca231f3107340272879da1a782159f9
Formbook
a442c0b593cfc03d8088a7cadd1788c222b43695c066a4c58b66b840319368db
Formbook
da90895ec14c13c733ba3550194ab36a4c64130c5c2b2038c163dff0c505b3e3
Formbook
eccce6ae6f8a2ed3c5edc1ede824681a9d4b9499139e4c00f2a85ca4684cec17
Formbook
+ 14'533 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:apg5 loader rat
Link:
https://tria.ge/reports/220328-jn9rqshac6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Xloader Payload
Xloader
Unpacked files
SH256 hash:
558b73b8294d032adc2aa65f6d2c43de573f4325c6a887203987d1025e95f638
MD5 hash:
0053da6ea34b65e2b89e5e794a098bc4
SHA1 hash:
985dcef83f4c0a2ffc8ffe24a064ab3751fc9c21
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/5866d166-811c-463e-bf9e-130cd7d0a1dc/
Parent samples :
eccce6ae6f8a2ed3c5edc1ede824681a9d4b9499139e4c00f2a85ca4684cec17
736fb3f0900c299f259ba08b2ac7c63b3b5aa08b40935d2a8b9c32e5056b81fa
3767dbe48449f355d429f2a4aecd212925ed1dfd69db1a7ff263c5660f58d571
735acbdbd4869497d9309e4c9a431285d2c08e5cfb503b5bb944a458823567aa
676f651c6b2e0bc3be79ddfc7c5ce1da527ccb97421928f1b806962c24a5fe50
b3ce300fd48a84260bdc0c018de94e23a976f537a8cf1a47c89219ddcf606337
SH256 hash:
59208a53a2be7fe3f834121abcc4d94c8811beed7a4f7075bca507eb86550d75
MD5 hash:
c007bc37fcd82eb088e5b2562a242809
SHA1 hash:
1c345fc3fb68ff6ff7fed34993d8fbf80186668f
Link:
https://www.unpac.me/results/5866d166-811c-463e-bf9e-130cd7d0a1dc/
SH256 hash:
736fb3f0900c299f259ba08b2ac7c63b3b5aa08b40935d2a8b9c32e5056b81fa
MD5 hash:
3cb5a88313d51e8d3c43d4ded0a6d759
SHA1 hash:
37b0dcca5b96f4acb1a7dda154d70e39b2fc8bc5
Link:
https://www.unpac.me/results/5866d166-811c-463e-bf9e-130cd7d0a1dc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.18
Link:
https://yomi.yoroi.company/submissions/736fb3f0900c299f259ba08b2ac7c63b3b5aa08b40935d2a8b9c32e5056b81fa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/258470/

Comments