MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7951a71c3d79cf0fb4e49c081f0a62c0b6fab2d26ab045a782f278d4826c1b7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7951a71c3d79cf0fb4e49c081f0a62c0b6fab2d26ab045a782f278d4826c1b7b
SHA3-384 hash: 687fbc1cb4c5fb9bf50570ec37ddc72f4cf4542c2c6101bd7534c628bb977d1d29d152a82f41412f2a9401897f9e6a66
SHA1 hash: bc023f4f3f1db489ff2b0bc40dbabf469cc73ae0
MD5 hash: 741cf68a75f90c5cfc372f65a591d75a
humanhash: blossom-kitten-berlin-gee
File name:ΤΙΜ-0000000183.pdf.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:749'741 bytes
First seen:2024-10-11 12:16:18 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:7ecJjJB5jq5Ty/4zVV7CRZ4D3MN3Yuips00sWnWh/lC18tIkd/nYlM3XZOXKsqL+:7bHt0SRZMc54SGZBYa3XpLdX0
TLSH T16EF423DFD3D3C60A99554231D26973D2908831A0DE5CF173BB96F4A227382268D8CEDB
Magika gzip
Reporter NDA0E
Tags:FakePDF FormBook geo GRC gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
NL NL
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:___-0000000183.pdf.exe
File size:962'056 bytes
SHA256 hash: 71c92f804b50550dc5e4df31c112cb9fc04b068b295d2cbfbccc14f1841d36bf
MD5 hash: 844bd5e1bd887e5c4688dde5dd175cdb
MIME type:application/x-dosexec
Signature Formbook
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27281.GZipHeur.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67091741385c9c6f6abe43cd
Tags:
underscore injection exploit obfusc
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/7951a71c3d79cf0fb4e49c081f0a62c0b6fab2d26ab045a782f278d4826c1b7b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7951a71c3d79cf0fb4e49c081f0a62c0b6fab2d26ab045a782f278d4826c1b7b/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2024-10-11 12:17:05 UTC
File Type:
Binary (Archive)
Extracted files:
30
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pfi2ohb5phhq7nhetqeb6ctcyc3pvmwsnkyelj4c6j4njatmdn5q._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/241011-razzdawblf/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7951a71c3d79cf0fb4e49c081f0a62c0b6fab2d26ab045a782f278d4826c1b7b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_Malicious_VBScript_Base64
Create hunting rule
Author:daniyyell
Description:Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.
Rule name:INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz 7951a71c3d79cf0fb4e49c081f0a62c0b6fab2d26ab045a782f278d4826c1b7b

(this sample)

Formbook

Executable exe 71c92f804b50550dc5e4df31c112cb9fc04b068b295d2cbfbccc14f1841d36bf

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 71c92f804b50550dc5e4df31c112cb9fc04b068b295d2cbfbccc14f1841d36bf
  
Dropping
MD5 844bd5e1bd887e5c4688dde5dd175cdb

Comments