MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89a7943f47dd4d160553813d7f4cea88a6b7e7134de0c6734c23942c7ece7764. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments

SHA256 hash:	89a7943f47dd4d160553813d7f4cea88a6b7e7134de0c6734c23942c7ece7764
SHA3-384 hash:	891f241b7c090d36afbc9f78fdd23df36e7e27625a26948d61e425519e5f47811bad64f3236ad3ae22e79cc3168dbad6
SHA1 hash:	12ed2b31a375212f69b0d9bcc3badd5ef67c7b9b
MD5 hash:	dd1e3de78e544010523cef9b3fab021a
humanhash:	fillet-robin-yellow-lactose
File name:	Shipment Arrival Notification of 772165397672.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	288'077 bytes
First seen:	2023-07-14 06:54:44 UTC
Last seen:	2023-07-14 07:02:38 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 431 x GuLoader)
ssdeep	6144:/Ya6lAcwcQmdiGpAw7geeddHCSOwTnnmksqvykV2B17UGV:/YvAF7GpAOgzddNOKnm7hz4GV
TLSH	T1425412195BE4EA73E9911B751E7FAE577FE89902302CA38F57501E007A2B6D04D0F3A2
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	cocaman
Tags:	exe FormBook payment

Intelligence

File Origin

# of uploads :

# of downloads :

261

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Shipment Arrival Notification of 772165397672.exe

Verdict:

Suspicious activity

Analysis date:

2023-07-14 07:03:03 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b7900e2f-5804-46da-92ca-6a1f216a4d03

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/418620/

Detection(s):

SecuriteInfo.com.Zum.Androm.1.2199.23883.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Creating a file

Unauthorized injection to a recently created process

Restart of the analyzed sample

Сreating synchronization primitives

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/97550/overview

Behaviour

MalwareBazaar

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

control lolbin masquerade overlay packed shell32

Link:

https://www.filescan.io/uploads/64b0f1492f8c5654cdda2d44/reports/d523a910-f443-42da-869b-1a9a0c23c6af/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/89a7943f47dd4d160553813d7f4cea88a6b7e7134de0c6734c23942c7ece7764

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1c5052e5-5131-4e37-9acb-df0bcd9113a1

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1272949

Signature

Detected unpacking (changes PE section rights)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/89a7943f47dd4d160553813d7f4cea88a6b7e7134de0c6734c23942c7ece7764/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2023-07-13 23:41:11 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rgtzip2h3vgrmbktqe6x6thkrctlpzytjxqmm42meokcy7woo5sa._file

Verdict:

malicious

Label(s):

formbook

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/230714-hpr3msdd3z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Loads dropped DLL

Unpacked files

SH256 hash:

89a7943f47dd4d160553813d7f4cea88a6b7e7134de0c6734c23942c7ece7764

MD5 hash:

dd1e3de78e544010523cef9b3fab021a

SHA1 hash:

12ed2b31a375212f69b0d9bcc3badd5ef67c7b9b

Link:

https://www.unpac.me/results/414d8c00-d5c1-4967-8243-671a4ad96027/

Malware family:

XLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/89a7943f47dd/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.