MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f2cc5439f4ede32445e247192c587fdb8b235be0f839c4dafeb36ac66388472. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f2cc5439f4ede32445e247192c587fdb8b235be0f839c4dafeb36ac66388472
SHA3-384 hash: 36157e014d2157e7fe2dd5d4d0c67f9d0afe6a4ef5fd17d0ea0b73e10bca73fce2dc10e81f5bd295b64e246227ad717c
SHA1 hash: 64cab810b28aa5b30ac29861b622c40c6ed4d07a
MD5 hash: b872e79713ce6bdaa1f23a468862dc16
humanhash: uranus-illinois-tennis-lamp
File name:NEW ORDER INQUIRY_B1020289.pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'033'216 bytes
First seen:2021-04-29 09:52:00 UTC
Last seen:2021-04-29 11:50:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:lVmSVoLAMOgTt9/jRmshHWywDZ+i3vnY8B:lVQO0txgwHFwACYs
Threatray 4'897 similar samples on MalwareBazaar
TLSH F8257DEC751074EEC3178C23A7CF1C11922025756A2BA90B972327BD5A2FE576F349CA
Reporter cocaman
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
12
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/146545/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.696-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/702173
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 400006 Sample: NEW ORDER INQUIRY_B1020289.... Startdate: 29/04/2021 Architecture: WINDOWS Score: 100 31 www.sarl-renov-bat.com 2->31 33 www.parkourtrading.com 2->33 35 parkourtrading.com 2->35 43 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 6 other signatures 2->49 11 NEW ORDER INQUIRY_B1020289.pdf.exe 3 2->11         started        signatures3 process4 file5 29 C:\...29EW ORDER INQUIRY_B1020289.pdf.exe.log, ASCII 11->29 dropped 59 Writes to foreign memory regions 11->59 61 Injects a PE file into a foreign processes 11->61 15 RegSvcs.exe 11->15         started        signatures6 process7 signatures8 63 Modifies the context of a thread in another process (thread injection) 15->63 65 Maps a DLL or memory area into another process 15->65 67 Sample uses process hollowing technique 15->67 69 2 other signatures 15->69 18 explorer.exe 15->18 injected process9 dnsIp10 37 www.wwwmichiganbulb.com 81.17.18.195, 49716, 80 PLI-ASCH Switzerland 18->37 39 progmao.com 51.91.199.155, 49714, 80 OVHFR France 18->39 41 10 other IPs or domains 18->41 51 System process connects to network (likely due to code injection or exploit) 18->51 22 systray.exe 18->22         started        signatures11 process12 signatures13 53 Modifies the context of a thread in another process (thread injection) 22->53 55 Maps a DLL or memory area into another process 22->55 57 Tries to detect virtualization through RDTSC time measurements 22->57 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7f2cc5439f4ede32445e247192c587fdb8b235be0f839c4dafeb36ac66388472/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-04-29 09:52:18 UTC
File Type:
PE (.Net Exe)
Extracted files:
31
AV detection:
19 of 47 (40.43%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p4wmkq47j3pderc6eryzfrmh7w4lenn6b6bzytnp5m3kyzryqrza._file
Verdict:
malicious
Similar samples:
1cb687fb145088863a9deb90dfac801c8d7bc03ea4938fcb8d800dca658b69e1
Formbook
414d26c286eeeda12cc3705aa3ed2ae06e901dc09795434e6abe4389f31c1e8e
Formbook
5ee7421dbf8127f1c6ff086299b2a1c638ca26a61a649f1cb61230814d0ff4e8
Formbook
6fac6e1f7f8cdd8cec52b2dd7a23fd434084c7d12ef0f04deaa52794d3612ef7
Formbook
7c201535a28746b62adfa831cfccac096903f5b17ee83b8364fc890fa70a59fd
Formbook
7d803e44c98cd23b971f692182f8d1d508fe82fb0fd6b681e7896c552d88411a
Formbook
86bca4941a28d08e94135a0bacc303f03cfd9b2f67e8979df496ba2e9d6ac93e
Formbook
cc58e505c504c770a1031d30453615f7748b0618b872655ac79a059a072c194c
Formbook
d3a729cac68f5147eb5b7a4e288196b37d0e7a02305529c591b060bcd36a843d
Formbook
fb3912c5b687ea7412dc249538d7c02b790f6edde2f23497c05faabd848cb16c
Formbook
+ 4'887 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210429-hbezs35han/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.huamxvcyq.icu/aepn/
Unpacked files
SH256 hash:
ab27e65aeea963f64c905ff2de090a34225e1432bffe86b7341a2d834e69927e
MD5 hash:
9ca213138b0773ba7a519b8b519e1179
SHA1 hash:
e6c39e016ebeaf5baccb0c67d6b3c09fc18e4e7d
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/a41cc68e-b778-452e-82e9-63330c0a1b9b/
Parent samples :
7f2cc5439f4ede32445e247192c587fdb8b235be0f839c4dafeb36ac66388472
13ec453c6271270eaea5be0958c7135ef449bd2ff1e74ad268fe76df32db5d72
SH256 hash:
ef092afafd01f5515b2aef4f6903d66802de6548ef533870b7be6da6a4004e52
MD5 hash:
f23d1ddfb20eb5b63d3995396f70f37b
SHA1 hash:
82d2e851626cabf57ac981d9570c3a3b10b1d152
Link:
https://www.unpac.me/results/a41cc68e-b778-452e-82e9-63330c0a1b9b/
SH256 hash:
74b2935b9dfe4ba397fd0507ae3c36abb77193041f2e7c43c55dc4e7b33de61c
MD5 hash:
b5c218f30fecc9cb8513ff6a46737b01
SHA1 hash:
f0416867c2b114789620b318051f1fa390b07eae
Link:
https://www.unpac.me/results/a41cc68e-b778-452e-82e9-63330c0a1b9b/
SH256 hash:
a8a611bc668857acacd4367e0eea4101e2de6483115af1c8829df73531e229c9
MD5 hash:
b345216721ebcce36266443ba7e89e28
SHA1 hash:
e5be0bda0b2b4c4e9b3a3fe79b25ab4f259916d1
Link:
https://www.unpac.me/results/a41cc68e-b778-452e-82e9-63330c0a1b9b/
SH256 hash:
7f2cc5439f4ede32445e247192c587fdb8b235be0f839c4dafeb36ac66388472
MD5 hash:
b872e79713ce6bdaa1f23a468862dc16
SHA1 hash:
64cab810b28aa5b30ac29861b622c40c6ed4d07a
Link:
https://www.unpac.me/results/a41cc68e-b778-452e-82e9-63330c0a1b9b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7f2cc5439f4ede32445e247192c587fdb8b235be0f839c4dafeb36ac66388472

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz f94e98462af69853708dcc3e752dafeb42995ddb322741f3f958460a210c164c

Formbook

Executable exe 7f2cc5439f4ede32445e247192c587fdb8b235be0f839c4dafeb36ac66388472

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 f94e98462af69853708dcc3e752dafeb42995ddb322741f3f958460a210c164c
Cape
Cape
https://www.capesandbox.com/analysis/146545/

Comments