MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 833a839bf412c22e06f2a3c0622e460df8fc5edbf55cdad09e7b76d5d73dacaa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | 833a839bf412c22e06f2a3c0622e460df8fc5edbf55cdad09e7b76d5d73dacaa |
|---|---|
| SHA3-384 hash: | f7a01d5c1fcb9efa21f492620a2ade80bb7f18d3d7fcbdcbfe4a56c85b92dc7c46e845a50a94cbdaeeb41d7d7dca9c4e |
| SHA1 hash: | 15d1e926b39e303246c0b25e82fc7b2cfc992b22 |
| MD5 hash: | ad811ed92c6019d5d577876977a3c529 |
| humanhash: | papa-mockingbird-carpet-oxygen |
| File name: | Inquiry.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 737'280 bytes |
| First seen: | 2023-04-29 01:25:38 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 12288:83UTbLLQ+8xAgZz9TB2RYkNd54Sf2CyxK3Km:83UbYTHB2/xO4 |
| Threatray | 3'220 similar samples on MalwareBazaar |
| TLSH | T150F4263C19BE223BC179D7A68FE5C527F01495AF3121AE75A4D78766430AE6234C323E |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer) |
| Reporter | Anonymous |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
606
Origin country :
CHVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Inquiry.exe
Verdict:
Suspicious activity
Analysis date:
2023-04-29 01:28:39 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Trojan.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj
Score:
68 / 100
Signature
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-04-26 10:59:34 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
25 of 37 (67.57%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 3'210 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
79ebbe5ccbc4bef9c07721cfaf0c733b4769382794482f40bff5967b7449a5be
MD5 hash:
98a5f3e48a3de289454230ea3acb45f4
SHA1 hash:
ed8dcd286132886bd0eeace8a46113d33ab55e85
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
42794e99927f4dcc692783444afee095e410e921b69e479662a68a304944bee2
MD5 hash:
e4a429836c5a555a001edb23b188e764
SHA1 hash:
fb776d6c6d15b54a8be1119ed96c8a4ff92875c5
SH256 hash:
58d2780bac07a53fa9ef0099c386ad23c2c5b83df99e18bbcca9895f829ef5d8
MD5 hash:
3a6ac846fbf56df68c3cb61cd18c7623
SHA1 hash:
e5b7f4e47b357f330b33330663ff5739a02d442f
SH256 hash:
55d505cac7784b6fbc4551e00a8dba570bef3cbbb00fa6e0d822336afa69a627
MD5 hash:
13bc67294b80069c593c61655a581ec7
SHA1 hash:
e3b309bedc7e30bed336a3e499af3c77964a4655
SH256 hash:
79e8b8d3f14c41946d7f6f6193eb64a477e498921bdfaf7e1601e330591bbd17
MD5 hash:
80f305082bab7524292bbcbee8c0b6c3
SHA1 hash:
c0cc1dc4dbd2fb76011eabeed8d4e3a62198804d
SH256 hash:
40c050c20d957d26b932faf690f9c2933a194aa6607220103ec798f46ac03403
MD5 hash:
c768bac25fc6f0551a11310e7caba8d5
SHA1 hash:
95f9195e959fb48277c95d1dd1c97a4edff7cb3a
SH256 hash:
833a839bf412c22e06f2a3c0622e460df8fc5edbf55cdad09e7b76d5d73dacaa
MD5 hash:
ad811ed92c6019d5d577876977a3c529
SHA1 hash:
15d1e926b39e303246c0b25e82fc7b2cfc992b22
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.