MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8676171a61775f7fef94dbc24a3fb4501d001d6b7e0ef7249ba517b41f011c10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 7
| SHA256 hash: | 8676171a61775f7fef94dbc24a3fb4501d001d6b7e0ef7249ba517b41f011c10 |
|---|---|
| SHA3-384 hash: | d184474b3ce6fddfba44405fdf0ec09e19cbe81d8c6729ae0b14ec1a149dd0278d869d3570204f2560f3bfe8548cb602 |
| SHA1 hash: | 80bd00b974e174ca0b6c774664ee853f2ef617fb |
| MD5 hash: | df09a7f722c82649cce020d28d7bcaee |
| humanhash: | snake-whiskey-six-mobile |
| File name: | Purchase Order & Inquiry.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 488'448 bytes |
| First seen: | 2020-10-07 04:46:10 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'453 x Formbook, 12'202 x SnakeKeylogger) |
| ssdeep | 6144:4nSi5Za+LKfq5sLfnvKWbhpR6NxWOFCcjmeBKCI9qVPjaXw+l0y:4nSivlLBiLXKOYNsgCcSeUFL |
| Threatray | 161 similar samples on MalwareBazaar |
| TLSH | 13A4AE736841986ECD9A47750DB144F1ED7602CE3F534E0F729E93080E25B2BBB1A66E |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
abuse_ch
Malspam distributing unidentified malware:HELO: fujitec.co
Sending IP: 209.11.159.147
From: Purchase Dept <mohan.j@fujitecindia.com>
Subject: New Order & Inquiry
Attachment: Purchase Order Inquiry.iso (contains "Purchase Order & Inquiry.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a file in the %temp% subdirectories
Creating a window
Launching the default Windows debugger (dwwin.exe)
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Signature
.NET source code contains very large array initializations
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Status:
Malicious
First seen:
2020-10-07 03:45:51 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 151 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Unpacked files
SH256 hash:
8676171a61775f7fef94dbc24a3fb4501d001d6b7e0ef7249ba517b41f011c10
MD5 hash:
df09a7f722c82649cce020d28d7bcaee
SHA1 hash:
80bd00b974e174ca0b6c774664ee853f2ef617fb
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
SH256 hash:
9e711e7d6d9a8f0cb54f0c83eb74ad7cb09f33310996cc7ad85f49907d65f0a3
MD5 hash:
d5b54f0f0fe63d9d0a9d2d608e158c6a
SHA1 hash:
52cab4fc7e5aac5f9784affd348a3f87afe498c7
SH256 hash:
a99740c73a026c01f9de5540c173e4c2534f03601e376e0cc238c4512051c47d
MD5 hash:
d1a9c2623ee15bea405333eab5565446
SHA1 hash:
5e36481ff6bd6f32d7c42840bd1a1a7307e05843
SH256 hash:
a7ea57c7bf17b3bbe5b6c01f9c95886dcd3f04c30c45b6ad002437805309bb51
MD5 hash:
88c614f5bed980fb37d354924190cb59
SHA1 hash:
68700da38792f5353a7475cbee8b00c71d55b557
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
1ed53de6facc62b95efabd31eeb7f48acc631052c1d999b6cd16ba302c6f2fca
MD5 hash:
fc31ed7bddf2fb9958711e0048e85b98
SHA1 hash:
af0857a551dc3be607d18fc9f4b5b5ad8f440c43
SH256 hash:
9f48bf05184afa72800ee0bfc32c563c65af76a5238148bce3ab17cd2f0f0094
MD5 hash:
2f31c0a62508003a4345a795b5113337
SHA1 hash:
c9fecacc77449f455f8954027873fc312ca8ae29
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.