MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79aa896551cd2738e5ff969ebf5e548fb5562f0f9238cdd6fe1f05a5fd89d4a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79aa896551cd2738e5ff969ebf5e548fb5562f0f9238cdd6fe1f05a5fd89d4a7
SHA3-384 hash: 4ed4018e1c43d048e90ae74f83f61b8bad8fda6e936bebda5fbae0d461c38b887425ee2374b9058fa8cfe9a25f778723
SHA1 hash: de3b25c5adab2a6e9ed9bdca709ffb2ebbbaa1da
MD5 hash: 96899b60547b18d1b6402ba0bff7b7e5
humanhash: romeo-cola-king-fish
File name:Arrival Notice.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:894'976 bytes
First seen:2025-02-27 22:55:48 UTC
Last seen:2025-03-03 14:06:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:Yiq98zzBP4/D2kM+OmQFnW4kQVC4pCDKeCzXTnv1gTmvYL6IeNFgeB0bdByv5iGq:Yi7HBXkMFmQ3FgOabCjTnv1gTmvoden
TLSH T16E15CF9C3610B59FC857C9328AA4EC74AA146CBA970BD20395D72DEFB90D997CF041F2
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter threatcat_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
518
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Arrival Notice.exe
Verdict:
No threats detected
Analysis date:
2025-02-27 23:02:24 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/05fbb43c-b5ba-44d4-a8af-90566eef4b46

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Packed.Agen-10026311-0
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67c0eda62dfba428b46ef540
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated obfuscated obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/67c0ed8d4a3011c802c36ecd/reports/e180de31-79d6-4fed-9825-990e0c16251d/overview
Verdict:
Malicious
Labled as:
Trojan.Heur3.CTR.Generic
Link:
https://www.hybrid-analysis.com/sample/79aa896551cd2738e5ff969ebf5e548fb5562f0f9238cdd6fe1f05a5fd89d4a7
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
KeyBase
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3e5c9923-93b6-4e38-ae78-340179395320
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1626091
Signature
.NET source code contains potential unpacker
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1626091 Sample: Arrival Notice.exe Startdate: 27/02/2025 Architecture: WINDOWS Score: 100 31 www.blogkart4u.xyz 2->31 37 Suricata IDS alerts for network traffic 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 Detected unpacking (changes PE section rights) 2->41 45 6 other signatures 2->45 10 Arrival Notice.exe 3 2->10         started        signatures3 43 Performs DNS queries to domains with low reputation 31->43 process4 file5 29 C:\Users\user\...\Arrival Notice.exe.log, ASCII 10->29 dropped 57 Injects a PE file into a foreign processes 10->57 14 Arrival Notice.exe 10->14         started        signatures6 process7 signatures8 59 Maps a DLL or memory area into another process 14->59 17 pr896L3PUAKl4Njm9Q3Wz6Z.exe 14->17 injected process9 signatures10 35 Found direct / indirect Syscall (likely to bypass EDR) 17->35 20 relog.exe 13 17->20         started        process11 signatures12 47 Tries to steal Mail credentials (via file / registry access) 20->47 49 Tries to harvest and steal browser information (history, passwords, etc) 20->49 51 Maps a DLL or memory area into another process 20->51 53 2 other signatures 20->53 23 pr896L3PUAKl4Njm9Q3Wz6Z.exe 20->23 injected 27 firefox.exe 20->27         started        process13 dnsIp14 33 www.blogkart4u.xyz 13.248.169.48, 49739, 80 AMAZON-02US United States 23->33 55 Found direct / indirect Syscall (likely to bypass EDR) 23->55 signatures15
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/79aa896551cd2738e5ff969ebf5e548fb5562f0f9238cdd6fe1f05a5fd89d4a7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79aa896551cd2738e5ff969ebf5e548fb5562f0f9238cdd6fe1f05a5fd89d4a7/
Threat name:
Win32.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2025-02-27 11:42:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pgviszkrzuttrzp7s2pl6xsur62vmlypsi4m3vx6d4c2l7mj2stq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
unknown_loader_037
Create hunting rule
Similar samples:
error
Formbook
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/250227-24tpkasxav/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Malicious
Tags:
Win.Packed.Agen-10026311-0
YARA:
n/a
Link:
https://app.threat.zone/submission/3b3159e5-f644-45d6-8845-d0b718bd0396
Unpacked files
SH256 hash:
79aa896551cd2738e5ff969ebf5e548fb5562f0f9238cdd6fe1f05a5fd89d4a7
MD5 hash:
96899b60547b18d1b6402ba0bff7b7e5
SHA1 hash:
de3b25c5adab2a6e9ed9bdca709ffb2ebbbaa1da
Link:
https://www.unpac.me/results/91cf0aae-e39f-4294-bf6a-7a9d8aa97194/
SH256 hash:
86bd1f0d325526b5300de3acbb8caae6c5e8276e666bea3537c91a6ec175ff95
MD5 hash:
ebe9e1ea5ff95795a61bdf074fb8858d
SHA1 hash:
b03ffbdea9e96bab740737c090426364d71d1c66
Link:
https://www.unpac.me/results/91cf0aae-e39f-4294-bf6a-7a9d8aa97194/
SH256 hash:
1a79be2e989cb57bbc0153962e511a1738e9fbadc4c17a83356e69842dcd44bc
MD5 hash:
d29ab4cae17beb3b9ecb357b044075d0
SHA1 hash:
a44bf1eaf8661ff35f1475fd5366eebed08e035b
Link:
https://www.unpac.me/results/91cf0aae-e39f-4294-bf6a-7a9d8aa97194/
SH256 hash:
2a110a936d9d8d833066ae4a13cc6b6a6f136db8b385d76b29d8d7cafdab1449
MD5 hash:
23d9a31d9dae9b93499e95d6cbea948a
SHA1 hash:
ac2f2eae497bc23a523fcfc8a8faa8c225834872
Link:
https://www.unpac.me/results/91cf0aae-e39f-4294-bf6a-7a9d8aa97194/
SH256 hash:
c8c0e9eca7823835ad2212a5e9105b17750b5f3357b661c23445be369c416734
MD5 hash:
bcf5fa8961588d701fa81bc07b1c8f43
SHA1 hash:
b2e4f757b43bc17f73ac1113d61a65a72c12d184
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/91cf0aae-e39f-4294-bf6a-7a9d8aa97194/
SH256 hash:
826f060d2ce280e9221a95e5791cf32107bd4fc2b9c94d39af52ee32594f85bb
MD5 hash:
40d7569f4bf50d9a2ae7875cb872db8c
SHA1 hash:
47e26f56591ccd381a1cbe2bf265436c49637d27
Link:
https://www.unpac.me/results/91cf0aae-e39f-4294-bf6a-7a9d8aa97194/
SH256 hash:
d972447fc55399cdf309c6ea20b371870bde14b0ae7a840119b88b0aace3b575
MD5 hash:
b46f6cb35aec6eaef3d0bbf248f8c8c7
SHA1 hash:
f6a2bac96767c149d3d8e5cccd1723ab12f9979e
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/91cf0aae-e39f-4294-bf6a-7a9d8aa97194/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/79aa896551cd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/79aa896551cd2738e5ff969ebf5e548fb5562f0f9238cdd6fe1f05a5fd89d4a7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 79aa896551cd2738e5ff969ebf5e548fb5562f0f9238cdd6fe1f05a5fd89d4a7

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments