MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 74d63d3b59e6068fdfa650d8a583b15a80e6a4dc68b54e38f4f21f5797a0f1b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
FormBook
Vendor detections: 4
| SHA256 hash: | 74d63d3b59e6068fdfa650d8a583b15a80e6a4dc68b54e38f4f21f5797a0f1b2 |
|---|---|
| SHA3-384 hash: | 111bd72381659d448d924d2ebd9f80b117300869311c79f4dabe380b6cc423d0a24f6a8df1bad8c94d72d9faa24e0eb1 |
| SHA1 hash: | 5eee76767b1a74ff92ce0e46c4e5a02e0f6a186f |
| MD5 hash: | fe131a31e142f27c997f23e6df3489f1 |
| humanhash: | montana-eighteen-quebec-edward |
| File name: | 8197ccfdbce15f81d6ad05daecd80af5.exe |
| Download: | download sample |
| Signature | FormBook |
| File size: | 172'032 bytes |
| First seen: | 2020-04-05 21:25:06 UTC |
| Last seen: | 2020-04-08 17:02:39 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| ssdeep | 3072:VT0RKdsP9UvYcj040c+2uijEXY3rOktXkLBvleVLt/:uk6w04dXHjKY7tME1 |
| Threatray | 3'314 similar samples on MalwareBazaar |
| TLSH | 01F39E36DA51C031E2B201B1F6BD0B7B883E4E34769551F6E3A126A06FB08A5F52931F |
| Reporter |  abuse_ch |
| Tags: | exe FormBook GuLoader |
abuse_ch
Payload dropped by GuLoader from the following URL:http://castmart.ga/~zadmin/icloud/j1_encrypted_798BCE0.bin
Intelligence
File Origin
# of uploads :
2
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Formbook
Status:
Malicious
First seen:
2020-04-05 21:35:27 UTC
File Type:
PE (Exe)
AV detection:
29 of 31 (93.55%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 3'304 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
806b51377a121da11b0ac5d62e8d9249eeb48fc29c1477e355a55b00e0e3308b
Dropped by
MD5 8197ccfdbce15f81d6ad05daecd80af5
Dropped by
MD5 fe633200da3e563bc6680bc720a685ae
Dropped by
GuLoader
Dropped by
SHA256 806b51377a121da11b0ac5d62e8d9249eeb48fc29c1477e355a55b00e0e3308b
Dropped by
SHA256 82703cd0470821f9a88d3da005aa5322bd1c95d92bdf7a1cfaf80f663197e8ee
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.