MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d4c2c1d0d3ef33d0ccdaccd9343ceacad4803cf789d7ec5c6fd7680a7720012. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	7d4c2c1d0d3ef33d0ccdaccd9343ceacad4803cf789d7ec5c6fd7680a7720012
SHA3-384 hash:	bde9b257f197e05381b768b03fbc94e9ef6a4ff5a6526be79c88d4a3b103b37212fa7078fe8b1fc3f4575ef9b7bfca94
SHA1 hash:	11f0e50388d84141ac28bcfb58cb6b22e760a518
MD5 hash:	15914ad76ee05eb029e14428220daefe
humanhash:	yellow-batman-lemon-artist
File name:	Invoice & Packing List.rar
Download:	download sample
Signature	Formbook Create hunting rule
File size:	647'726 bytes
First seen:	2023-04-09 08:50:22 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:ev0aJl6hGR+ABW/ZUP2k0wEb8QWKfCiSjgFyQbd2MrU+rBqR0m+mzzw4+J2:ONR+ABWhUP2eEDW/iSjgFyEdxr1trs1
TLSH	T140D4234584AA31884FFCB10450F9EC2A78989D1435F957E2EC3B219A7EF534B0EBD297
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	INVOICE rar

cocaman

Malicious email (T1566.001)
From: "Abbas Majid <docsmumbai@indoglobeservice.com>" (likely spoofed)
Received: "from indoglobeservice.com (unknown [103.125.190.179]) "
Date: "9 Apr 2023 01:49:10 -0700"
Subject: "FW: RE: RE: Commercial Invoice & packing list"
Attachment: "Invoice & Packing List.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

200

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Invoice & Packing List.exe
File size:	811'520 bytes
SHA256 hash:	830b7b74693b870abe6d20862ab5f5ab206cdf6e49755d9d542c9124f6646c1e
MD5 hash:	52a39381c7a50d7d0a5800d41c5196f6
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/7d4c2c1d0d3ef33d0ccdaccd9343ceacad4803cf789d7ec5c6fd7680a7720012/results/dashboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

formbook packed

Link:

https://www.filescan.io/uploads/64327c76bf68c1790afb1f59/reports/b84cccd9-6c1e-406d-8678-b8e198a1eb7f/overview

Verdict:

Suspicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/7d4c2c1d0d3ef33d0ccdaccd9343ceacad4803cf789d7ec5c6fd7680a7720012

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7d4c2c1d0d3ef33d0ccdaccd9343ceacad4803cf789d7ec5c6fd7680a7720012/

Threat name:

Win32.Trojan.Woreflint

Status:

Malicious

First seen:

2023-04-09 08:51:07 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

6 of 37 (16.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pvgcyhinh3zt2dgnvtgzgq6ovswuqa6ppcox5rog7v3ibj3saaja._file

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/230409-lnr8sscb7w/

Behaviour

Creates scheduled task(s)

Gathers network information

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7d4c2c1d0d3ef33d0ccdaccd9343ceacad4803cf789d7ec5c6fd7680a7720012

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.