MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8132806c05668768f28af83ccb49438520dcb0ece18326db9698623152f35018. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8132806c05668768f28af83ccb49438520dcb0ece18326db9698623152f35018
SHA3-384 hash: 611cbd937fb761dbe9cdbfdadb32bdb10dea5f2235a95fbe5df086aaf43d666a5031da0be7800399941f2e41fb39d6e6
SHA1 hash: 5ee4b2631494f8bf17baa16559cc39637d142e23
MD5 hash: 64bd6807bc6e2be31604775fd216ee41
humanhash: stairway-wisconsin-enemy-purple
File name:DANONE - demande de devis.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:424'822 bytes
First seen:2023-09-08 19:47:12 UTC
Last seen:2023-09-11 10:12:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep 12288:/YK09IkE+LKsDTiqzthikwK+8AxLhyVI5Atl:/YKS7vPvj+8ASIA
Threatray 13 similar samples on MalwareBazaar
TLSH T163942314B792D56BF9B21B324F3E57073AFADA602436A30E2B20CF4D7666111D60FB52
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
344
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
DANONE - demande de devis.exe
Verdict:
Malicious activity
Analysis date:
2023-09-08 19:53:02 UTC
Tags:
formbook xloader stealer spyware
Link:
https://app.any.run/tasks/6641f8e6-486b-4bdc-ab15-51a88901189d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/447590/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.1815.7223.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Launching a process
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Gathering data
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/8132806c05668768f28af83ccb49438520dcb0ece18326db9698623152f35018
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/21b26d9e-4a1b-48d8-b178-f2d96fc14f35
Result
Threat name:
FormBook, NSISDropper
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1306475
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Queues an APC in another process (thread injection)
Yara detected FormBook
Yara detected NSISDropper
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8132806c05668768f28af83ccb49438520dcb0ece18326db9698623152f35018/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-09-08 07:35:54 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qezia3afm2dwr4uk7a6mwskdquqnzmhm4gbsnw4wtbrdcuxtkama._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
13e982225c8c2c3a496943c893f68f5df437a2fec9a1709648ecb57f99c1bd3f
Formbook
1706f846eef66c0ced9bda22b412a48c9f7aa026d13c7173d2687fd8629f6a27
Formbook
21f03aa3cb1ce12b742fc78552681e20099f77f1aa347516a253e383eb5f3f11
Formbook
3adb8aeb7691dc238ebd6c61ae7a0f7bdac303f547d02109d5d23bf096403733
Formbook
63b59f1390003e44ffbd4460d2b6811586b1aaaf155a64186397002160b370c6
Formbook
690fc14f8b0395e7390646c6832d462bd421bc7caa1caa5f66654b7252a0e102
Formbook
a3ac1a13b363264a45374dbc9a485e19f80d71cefa4f3cb72a902d46c667330a
Formbook
d1fb7e74ddc8117a5eb3c57b607ac4eee92c9d67a8138fcb12c4d4995ef8109a
Formbook
d44232f2022c8c9e948b4fc026cc391959c2e662a152b77e95dede5989320c27
Formbook
f93a11630922fd15cbee49f2d7b94a2e9ba7805c333ec30088b46435455027d5
Formbook
+ 3 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230908-yh35bsfa84/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
b01206a3d13395c25d01a1179e9598fdf910ac0a54e9065c67d0804317bd886b
MD5 hash:
9b25f162421c93d12ad364e0edd9fa48
SHA1 hash:
debe1f28ddc99ed98d64251e783c449a4335a469
Link:
https://www.unpac.me/results/472771e1-5a22-45bd-9310-0c1ecc0e27ac/
SH256 hash:
8132806c05668768f28af83ccb49438520dcb0ece18326db9698623152f35018
MD5 hash:
64bd6807bc6e2be31604775fd216ee41
SHA1 hash:
5ee4b2631494f8bf17baa16559cc39637d142e23
Link:
https://www.unpac.me/results/472771e1-5a22-45bd-9310-0c1ecc0e27ac/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8132806c0566/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8132806c05668768f28af83ccb49438520dcb0ece18326db9698623152f35018

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 8132806c05668768f28af83ccb49438520dcb0ece18326db9698623152f35018

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/447590/

Comments