MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84176781043f8f95306328477f7b28fa721f44b1767fe740cbd207233c2a47c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84176781043f8f95306328477f7b28fa721f44b1767fe740cbd207233c2a47c6
SHA3-384 hash: b89853beed4b87e5992743b99124e8f4242d7acad7d0804469a2eb2f76cdf6ea4e5dbddc92d012e27a9d323a843a6fd4
SHA1 hash: 66cabe97357baf824cece3191f59f92ee3fc3019
MD5 hash: 14d1f9fe1739050d297d56b1d848cbb8
humanhash: glucose-vegan-early-oxygen
File name:AWB5889829680.scr
Download: download sample
Signature Formbook
Create hunting rule
File size:32'256 bytes
First seen:2024-04-03 13:23:30 UTC
Last seen:2024-04-04 05:18:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'743 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 768:MT7lDBcORAwAtAeAtaEExVmTF2uoxF03HjmBAtHzae6j:MhOOm1yfnEmTF2z0KBAtKj
Threatray 324 similar samples on MalwareBazaar
TLSH T19CE21A82B6E86B37D5FD93F519B321101BF1A46B6423D7092DC660DF0A76F4006A2F6B
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon 0038e68293927011 (2 x Formbook, 1 x AsyncRAT)
Reporter cocaman
Tags:DHL exe FormBook scr

Intelligence

File Origin
# of uploads :
3
# of downloads :
309
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
84176781043f8f95306328477f7b28fa721f44b1767fe740cbd207233c2a47c6.exe
Verdict:
Malicious activity
Analysis date:
2024-04-03 13:55:20 UTC
Tags:
formbook xloader
Link:
https://app.any.run/tasks/ee6e86a1-95ec-4791-911d-c19b3cdeae82

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Launching a process
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/84176781043f8f95306328477f7b28fa721f44b1767fe740cbd207233c2a47c6
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/65cbbea5-29a1-4830-a155-76b34dc8c60c
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1419442
Signature
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected FormBook
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1419442 Sample: AWB5889829680.scr.exe Startdate: 03/04/2024 Architecture: WINDOWS Score: 100 32 www.99b6q.xyz 2->32 34 www.xn--matfrmn-jxa4m.se 2->34 36 20 other IPs or domains 2->36 42 Snort IDS alert for network traffic 2->42 44 Multi AV Scanner detection for domain / URL 2->44 46 Malicious sample detected (through community Yara rule) 2->46 50 5 other signatures 2->50 10 AWB5889829680.scr.exe 15 3 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 32->48 process4 dnsIp5 38 cdn.discordapp.com 162.159.130.233, 443, 49710 CLOUDFLARENETUS United States 10->38 60 Injects a PE file into a foreign processes 10->60 14 AWB5889829680.scr.exe 10->14         started        signatures6 process7 signatures8 62 Maps a DLL or memory area into another process 14->62 17 IDXgIaEzJZZai.exe 14->17 injected process9 dnsIp10 26 www.touchclean.top 67.223.117.189, 49750, 49751, 49753 VIMRO-AS15189US United States 17->26 28 exclaimer342200213.net 84.33.215.91, 49768, 49769, 49770 SERVER24-ASINCUBATECGmbH-SrlIT Italy 17->28 30 9 other IPs or domains 17->30 40 Found direct / indirect Syscall (likely to bypass EDR) 17->40 21 dfrgui.exe 13 17->21         started        signatures11 process12 signatures13 52 Tries to steal Mail credentials (via file / registry access) 21->52 54 Tries to harvest and steal browser information (history, passwords, etc) 21->54 56 Modifies the context of a thread in another process (thread injection) 21->56 58 Maps a DLL or memory area into another process 21->58 24 firefox.exe 21->24         started        process14
Score:
24%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/84176781043f8f95306328477f7b28fa721f44b1767fe740cbd207233c2a47c6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/84176781043f8f95306328477f7b28fa721f44b1767fe740cbd207233c2a47c6/
Threat name:
Win32.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2024-04-03 12:24:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qqlwpaieh6hzkmddfbdx66zi7jzb6rfroz76oqgl2idsgpbki7da._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
25ddae2daf0f3117cfed10da3447d26c5291a324b44534ed692a873934bac628
Formbook
70f27cc87397701a73835625b0ee8caf3ef97b506554f2a7f65c2c08afd264f7
Formbook
8cb37e1ab48747e7fb63dd2ac1bffe1c9f0fa98c160613922a995935d6abd2cc
Formbook
99450e636243dad54861d58c1e62fae329b69b4c9af6ed1f53fba851d20b2fa7
Formbook
9acf79ea7507e73dadecddb7340b4162623a6f46289eb70517c5ff39121c11d0
Formbook
a39d4b589dc608fa2dfc06259a2d15b9a7edd2ed8d0a3adde6b71151db0a7102
Formbook
bf1f882e2a1d0e35207cd7cab867bffe933e134e43ff317acf2db538bd4d7210
Formbook
c7a16881f8c69d16a9b0bdcbfdd5c4aada81eba19521d1c03ee7f6005f7d6629
Formbook
cb348e8dbd6c518a9ad671a9fb235cea3eeba8b7036fc5498f6b118d4bc3060b
Formbook
d806f682d459f166ee4cb6a5a82a2c38e70cbdec81358749315e60f97550778a
Formbook
+ 314 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240403-qncwbsdf51/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
84176781043f8f95306328477f7b28fa721f44b1767fe740cbd207233c2a47c6
MD5 hash:
14d1f9fe1739050d297d56b1d848cbb8
SHA1 hash:
66cabe97357baf824cece3191f59f92ee3fc3019
Detections:
SUSP_PE_Discord_Attachment_Oct21_1
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Link:
https://www.unpac.me/results/d9f3284a-9897-434f-ba26-4debc1b14418/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/84176781043f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/84176781043f8f95306328477f7b28fa721f44b1767fe740cbd207233c2a47c6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_Discord_Attachments_URL
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads
Rule name:SUSP_PE_Discord_Attachment_Oct21_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar a4ec306da2adb14c21343e964d46ddc833ab727266c3d46b382ae69c703230ae

Formbook

Executable exe 84176781043f8f95306328477f7b28fa721f44b1767fe740cbd207233c2a47c6

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 a4ec306da2adb14c21343e964d46ddc833ab727266c3d46b382ae69c703230ae
  
Dropped by
MD5 4b82673a736660fde870884c40298035

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments