MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7a47a855968f4e82d6cc2d35186d2d56468701bc5587cc87f82a847bd2c45ae5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 12
| SHA256 hash: | 7a47a855968f4e82d6cc2d35186d2d56468701bc5587cc87f82a847bd2c45ae5 |
|---|---|
| SHA3-384 hash: | cf12c5584091cdb75e6e8f0d08d065650ae6dd2e80bf1b2b7922f012ec51a96e7a33bcc2c023faa4728751139e962eae |
| SHA1 hash: | bd1e997473e71ae2e8021298149b692cb84aab54 |
| MD5 hash: | 31dddef6168b1d0e0f731f01eca9ea58 |
| humanhash: | beryllium-aspen-uncle-mars |
| File name: | PI_JAN9071011998_BARYSLpdf.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 964'096 bytes |
| First seen: | 2021-01-15 15:57:47 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'660 x AgentTesla, 19'470 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:pcKaEliBAqDQdu/olX15yF9Yt9gusNqdLu+Sa7:pcKllIABxdLyIt9g5cg+r |
| Threatray | 3'468 similar samples on MalwareBazaar |
| TLSH | CA25AE7C2B7BBE4CD17916B60EE1582707623D0624F8D61E0CE97ECA0576B401DA9EB3 |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
abuse_ch
Malspam distributing unidentified malware:HELO: cpanel3.centrin.net.id
Sending IP: 202.146.241.47
From: jyyoo@jsmold.co.id
Subject: Re: Revised PO - Barysl Logistics
Attachment: PI_JAN9071011998_BARYSLpdf.arj (contains "PI_JAN9071011998_BARYSLpdf.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
303
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PI_JAN9071011998_BARYSLpdf.exe
Verdict:
Malicious activity
Analysis date:
2021-01-15 16:38:59 UTC
Tags:
trojan formbook stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Found malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Detection:
formbook
Threat name:
ByteCode-MSIL.Spyware.Noon
Status:
Malicious
First seen:
2021-01-15 08:34:10 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 3'458 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook rat spyware stealer trojan
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.thedilleyo.com/kb8/
Unpacked files
SH256 hash:
7a47a855968f4e82d6cc2d35186d2d56468701bc5587cc87f82a847bd2c45ae5
MD5 hash:
31dddef6168b1d0e0f731f01eca9ea58
SHA1 hash:
bd1e997473e71ae2e8021298149b692cb84aab54
SH256 hash:
ffe566637e3bb2f01c852d655a58cc6d57ff81d33e85467b71914954219d7d79
MD5 hash:
38bdb2255223358c7d68d2ac56dd814a
SHA1 hash:
b0b4e5c6cb34cef2d58780923ab2adc580447fce
SH256 hash:
232c4a2b3e780581f756cfb09310d92748331b3354a2156bc7027ef5e8ccab97
MD5 hash:
1a21af697dc5e1f378b3115b2ba00f60
SHA1 hash:
fe45f9a0dded9ccf3af215c4ce43e692d31dd946
SH256 hash:
bd3d95cd8278b7936e61854a13e0c267ad4a321d82778e85385f52b362cd11e2
MD5 hash:
7e9d4f8a65f2c3fa8237991dbb7df22b
SHA1 hash:
f186ee95dd9aee96861e56b20341a0da7e4d4eb8
Detections:
win_formbook_g0
win_formbook_auto
Parent samples :
7a47a855968f4e82d6cc2d35186d2d56468701bc5587cc87f82a847bd2c45ae5
7139fbd600738d2f456c7f11ae105e45ab0bb6e14a473ae0e68391b8125da393
458bd08f0c32719adc9d2858721b609b136ff0e21c2f3ac3f4be4f97e4084b7a
d4dc8610837799abecadc4d3db1f6a8cbbce340de07b90e9868603f50c7fe762
044d4416e986fb7fd91bc96639efe48e87cfd33857e199c48cf6e7f4d07a3db2
7139fbd600738d2f456c7f11ae105e45ab0bb6e14a473ae0e68391b8125da393
458bd08f0c32719adc9d2858721b609b136ff0e21c2f3ac3f4be4f97e4084b7a
d4dc8610837799abecadc4d3db1f6a8cbbce340de07b90e9868603f50c7fe762
044d4416e986fb7fd91bc96639efe48e87cfd33857e199c48cf6e7f4d07a3db2
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.