MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 894cccc6062828bd1da8c963ffac44668d013feebf2dcac3230b139bd3b1a9f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 894cccc6062828bd1da8c963ffac44668d013feebf2dcac3230b139bd3b1a9f4
SHA3-384 hash: 166babdbdbc78de76c1afc49cdb59418c5e2e5699fe03f8c1c1aa31ddfcba7c33ec42fe5f896b6fcb032666322724255
SHA1 hash: 56a5d07158deb7c5c10b96b2d6e1b581bd056ced
MD5 hash: 9716f7b69abdbedc235352468f5c4012
humanhash: lactose-jupiter-single-november
File name:USD46k Swift_PDF.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'177'600 bytes
First seen:2024-05-27 10:17:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bd3825b6e0410966f0c31f64b6c7644a (36 x AgentTesla, 15 x Formbook, 6 x RemcosRAT)
ssdeep 24576:pAHnh+eWsN3skA4RV1Hom2KXcmtcM9u9Bij/R4F1:wh+ZkldoPKsacM09Y94
TLSH T17145AD0273D1C036FFABA2739B6AF2455ABD79254133852F13982D79BD701B2133E662
TrID 49.2% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
22.7% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
311
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
894cccc6062828bd1da8c963ffac44668d013feebf2dcac3230b139bd3b1a9f4.exe
Verdict:
Malicious activity
Analysis date:
2024-05-27 10:18:25 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/01fc44ae-4eb5-428b-a7d5-67d25eea35d5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.Embedpe-3
Create hunting rule

PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66545f58121317197511fdd9win7simulatehigh_evasion
Tags:
Malware
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit fingerprint keylogger lolbin masquerade packed shell32
Link:
https://www.filescan.io/uploads/66545df69ef257851a9a188a/reports/9594a547-f256-429a-aafa-dbc420b2d09f/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/894cccc6062828bd1da8c963ffac44668d013feebf2dcac3230b139bd3b1a9f4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2a237988-a9b2-4376-ad7e-f3610891edcf
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1447905
Signature
Binary is likely a compiled AutoIt script file
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/894cccc6062828bd1da8c963ffac44668d013feebf2dcac3230b139bd3b1a9f4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/894cccc6062828bd1da8c963ffac44668d013feebf2dcac3230b139bd3b1a9f4/
Threat name:
Win32.Trojan.Strab
Create hunting rule
Status:
Malicious
First seen:
2024-05-23 15:53:51 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rfgmzrqgfaul2hnizfr77lcem2gqcp7ox4w4vqzdbmjzxu5rvh2a._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240527-mb1j3sgc2z/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
AutoIT Executable
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8d6d6f9a-1c0e-4336-9fff-c822eb73cd5d
Unpacked files
SH256 hash:
c96b0434bf5ecbba4a9996ebde7aa5fd6bb1683b28ba3d644c922e9bac24d9d0
MD5 hash:
3a20bf3823838f87a2ccec9fb578cecb
SHA1 hash:
9a70940c6dfe4704be44ab0b9107d0b54466daec
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/11c2cf5a-d54d-484f-bd1b-1ed733cc676c/
Parent samples :
894cccc6062828bd1da8c963ffac44668d013feebf2dcac3230b139bd3b1a9f4
26b84040c5139e2f58d2afe18411bc21e4507bfe97a253312b6f0ed32cb315f6
SH256 hash:
2d50f0c59f7dc2fc5c3591b51e1c53f48ff549d770fb64cff433fe80bafc38cb
MD5 hash:
d120edc03d77ece5b524935ebf7f1cc6
SHA1 hash:
4ca4f445f4a5d184d6a7088579af2bc5e57e2a85
Link:
https://www.unpac.me/results/11c2cf5a-d54d-484f-bd1b-1ed733cc676c/
SH256 hash:
6bb87de1156e5c1334a5cf933ba09012a5e9e1dcddffb65cf101abf55eb9c1a4
MD5 hash:
d58cf723f94a9d29f85f3ed3903b19de
SHA1 hash:
fb7c79a6cc6e5e50c45fe5a72bc0ea7b02745d7a
Link:
https://www.unpac.me/results/11c2cf5a-d54d-484f-bd1b-1ed733cc676c/
SH256 hash:
2c64e8c17460c7072bb4f827f2305307007d2f3097f41c56c3773ed2e5038e6e
MD5 hash:
b80469f8f634fed1bc7e508a16ab8ff1
SHA1 hash:
8f7f3f5ca258554e0015a7c5ab4a4846945cc95c
Link:
https://www.unpac.me/results/11c2cf5a-d54d-484f-bd1b-1ed733cc676c/
SH256 hash:
60fae86a1cd540e0c599daab7da2c31f793e56d3baf7cab5d88081e30ec6e322
MD5 hash:
d6bf4a98e05225aeedd83c0544bc3be2
SHA1 hash:
89f4d9dc93a27c51aa5b9fb13a2979149ffbd738
Link:
https://www.unpac.me/results/11c2cf5a-d54d-484f-bd1b-1ed733cc676c/
SH256 hash:
df4736da53b6cb0fade0ae028c0498d6500896a46c5f794bcc183f795f8f2499
MD5 hash:
b9a0a2890531b0f9ffea80637e0bf35d
SHA1 hash:
5f4aab6d795d2b4af08d7a52a107ecd5f3cc6d89
Link:
https://www.unpac.me/results/11c2cf5a-d54d-484f-bd1b-1ed733cc676c/
SH256 hash:
4b9c394a56207d876eb7c53475f5f17d5158ebb0d327872944f96aae9114b344
MD5 hash:
324fc40f870fa11a6d306e3bf5e55f21
SHA1 hash:
546856d38682c59c64cee092612bbb1c6af3eab9
Link:
https://www.unpac.me/results/11c2cf5a-d54d-484f-bd1b-1ed733cc676c/
SH256 hash:
bbe2b5da98938d8ccb263225bbbbba80d040e69056e0e371d3cc2c1f8bea4825
MD5 hash:
972c0108d112f40d716a388134f6d309
SHA1 hash:
377d31f5346f54852530b60a622e8a8fc58a6dc1
Link:
https://www.unpac.me/results/11c2cf5a-d54d-484f-bd1b-1ed733cc676c/
SH256 hash:
894cccc6062828bd1da8c963ffac44668d013feebf2dcac3230b139bd3b1a9f4
MD5 hash:
9716f7b69abdbedc235352468f5c4012
SHA1 hash:
56a5d07158deb7c5c10b96b2d6e1b581bd056ced
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/11c2cf5a-d54d-484f-bd1b-1ed733cc676c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/894cccc6062828bd1da8c963ffac44668d013feebf2dcac3230b139bd3b1a9f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 894cccc6062828bd1da8c963ffac44668d013feebf2dcac3230b139bd3b1a9f4

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::CopySid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::GetAce
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.DLL::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.DLL::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::TerminateProcess
KERNEL32.DLL::SetSystemPowerState
KERNEL32.DLL::LoadLibraryA
KERNEL32.DLL::LoadLibraryExW
KERNEL32.DLL::LoadLibraryW
KERNEL32.DLL::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.DLL::WriteConsoleW
KERNEL32.DLL::ReadConsoleW
KERNEL32.DLL::SetStdHandle
KERNEL32.DLL::GetConsoleCP
KERNEL32.DLL::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.DLL::CopyFileExW
KERNEL32.DLL::CopyFileW
KERNEL32.DLL::CreateDirectoryW
KERNEL32.DLL::CreateHardLinkW
KERNEL32.DLL::CreateFileW
IPHLPAPI.DLL::IcmpCreateFile
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.DLL::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments