MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a12f38cc2bd503f9667620f86315281e8319f9f2dca72aa19eb19ff6f3629a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a12f38cc2bd503f9667620f86315281e8319f9f2dca72aa19eb19ff6f3629a6
SHA3-384 hash: 4b71f8b7dc38ff58d1ff0c36ad3fa277b8d406d170ef20c55521f5af48954bc5b92a7f5f0110665bb73a1d1a453956df
SHA1 hash: b066758974a6efef88abd3e772171a4bab89d1e8
MD5 hash: 97bc9fc82cdd0607f0bd1e83622b80ba
humanhash: april-wisconsin-undress-seven
File name:SDL_Order Onayı _ Acil,pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:468'871 bytes
First seen:2021-10-19 14:18:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:FBlL/H4sYGXW+W9PTqKkq0KjtS8AE5gktrPnO1+RJRUw167GVRiG62:TKGXW+WJTe8xSAgktTOoRJ+wCSkG5
Threatray 10'827 similar samples on MalwareBazaar
TLSH T190A428C1D2483CF9F81A17724D36AD222157BE7D99B4542E695EF42A5AF328330F2C1B
File icon (PE):PE icon
dhash icon 1f1c4bca1b2d1f1b (3 x SnakeKeylogger, 2 x Formbook, 1 x RemcosRAT)
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/198562/
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.27725.17495.13935.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/616ed3d8a9d585e6d52e0542/reports/95104cb4-98d4-4d64-9c7d-8a404505ba61/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/97e5c57d-229b-41c3-829b-7378c7bfb3b9
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/873392
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 505829 Sample: SDL_Order Onay#U0131 _ Acil... Startdate: 19/10/2021 Architecture: WINDOWS Score: 100 31 www.onewebuy.net 2->31 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 11 other signatures 2->45 11 SDL_Order Onay#U0131 _ Acil,pdf.exe 17 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\Local\...\nrxdd.dll, PE32 11->29 dropped 59 Injects a PE file into a foreign processes 11->59 15 SDL_Order Onay#U0131 _ Acil,pdf.exe 11->15         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 Queues an APC in another process (thread injection) 15->67 18 explorer.exe 15->18 injected process9 dnsIp10 33 www.staygood.gmbh 89.31.143.1, 49775, 80 QSC-AG-IPXDE Germany 18->33 35 www.y6pw.xyz 34.117.219.158, 49848, 80 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 18->35 37 12 other IPs or domains 18->37 47 System process connects to network (likely due to code injection or exploit) 18->47 49 Performs DNS queries to domains with low reputation 18->49 22 mstsc.exe 18->22         started        signatures11 process12 signatures13 51 Self deletion via cmd delete 22->51 53 Modifies the context of a thread in another process (thread injection) 22->53 55 Maps a DLL or memory area into another process 22->55 57 Tries to detect virtualization through RDTSC time measurements 22->57 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7a12f38cc2bd503f9667620f86315281e8319f9f2dca72aa19eb19ff6f3629a6/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-10-19 11:20:00 UTC
AV detection:
15 of 44 (34.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pijphdgcxvid7fthmihymmksqhuddh47fxfhfkqz5mm763zwfgta._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
030d67d113b2193c850c7ac4d993c571b478ce61d12b892a8feecc2938775d91
Formbook
098a32bfcd332f71fdb65cf704994c70cf6390110340c809ae2cc66bddfbde04
Formbook
61a69b0eb00727462d5599153fb2acb617d15fcc2e9e4ec3270a5fca8837a3ba
Formbook
75772375acbcfb6cb668fc2449671a6a83afe1434184ac7c01fd895825fcf5e6
Formbook
7a8cd0fb35936203195d49af3fec0140f45e8b8fb75df0203db6b914d4b8d192
Formbook
b503be7988f66c2820e5f9a13b6e53ba9b8d14011069c6c809065cf08463e22b
Formbook
d079479dd85fb94fe08f6cd70cfff35e39c14294174a8ed6f9b480ffc1cbc9b2
Formbook
+ 10'817 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/211019-rmt9nagaa9/
Behaviour
Enumerates physical storage devices
Unpacked files
SH256 hash:
5635eb2b841d6af69d6ffea622a56f603483f1ecc97c98632d6b73621ab1d29c
MD5 hash:
4aa6867fd45aed347b54096e3eb29bca
SHA1 hash:
66a9294a2a2f4143d263beda18e93ba076415678
Link:
https://www.unpac.me/results/2974b9ac-731b-4980-91ad-609990ce2dc3/
SH256 hash:
7a12f38cc2bd503f9667620f86315281e8319f9f2dca72aa19eb19ff6f3629a6
MD5 hash:
97bc9fc82cdd0607f0bd1e83622b80ba
SHA1 hash:
b066758974a6efef88abd3e772171a4bab89d1e8
Link:
https://www.unpac.me/results/2974b9ac-731b-4980-91ad-609990ce2dc3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/7a12f38cc2bd503f9667620f86315281e8319f9f2dca72aa19eb19ff6f3629a6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 7a12f38cc2bd503f9667620f86315281e8319f9f2dca72aa19eb19ff6f3629a6

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/198562/

Comments