MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8cdf7e716de26cf91167752202a426e1ba52756ffff52d30a576b1a412da500f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8cdf7e716de26cf91167752202a426e1ba52756ffff52d30a576b1a412da500f
SHA3-384 hash: 8d9a17e57829976901b73a1e56c2e3faf83402f4f7a68e626761bfe92b56cf2c6c0be8981a4204540c9637808dca367f
SHA1 hash: 6018abfd31f0d875772edcee830c74f8be0d24eb
MD5 hash: a65429f63b263bf8c9ff7e7fe8d5cd5b
humanhash: fish-equal-uncle-fruit
File name:MV ALIADO - S-REQ-19-00064.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'342'464 bytes
First seen:2024-09-10 13:07:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 948cc502fe9226992dce9417f952fce3 (1'182 x CredentialFlusher, 446 x Formbook, 231 x AgentTesla)
ssdeep 24576:NqDEvCTbMWu7rQYlBQcBiT6rprG8aGfCaMLs5L4maFA9iHwbN:NTvC/MTQYxsWR7aGnMLs5LGFAiHwb
TLSH T19D55C00273D1D062FF9B92334B5AF6115BBC69260123E62F13A81D79BE701B1563E7A3
TrID 68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.5% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
File icon (PE):PE icon
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
416
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
MV ALIADO - S-REQ-19-00064.exe
Verdict:
Malicious activity
Analysis date:
2024-09-10 13:08:37 UTC
Tags:
autoit
Link:
https://app.any.run/tasks/e8a7ea9e-3341-4779-bc1f-d62eb17a2408

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Generic.33203615.28472.17882.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66e044b576bc4542b04956e9
Tags:
Inject
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit epmicrosoft_visual_cc fingerprint keylogger lolbin microsoft_visual_cc packed shell32
Link:
https://www.filescan.io/uploads/66e044b3c97eb38a1fe3b734/reports/4ae124fb-abff-4605-856e-6b38c2ec5d47/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/8cdf7e716de26cf91167752202a426e1ba52756ffff52d30a576b1a412da500f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6f7e0c9c-0b60-48a2-b9ca-73271b6f6f55
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1508661
Signature
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8cdf7e716de26cf91167752202a426e1ba52756ffff52d30a576b1a412da500f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8cdf7e716de26cf91167752202a426e1ba52756ffff52d30a576b1a412da500f/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2024-09-09 01:17:24 UTC
File Type:
PE (Exe)
Extracted files:
27
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rtpx44ln4jwpselhourafjbg4g5fe5lp772s2mffo2y2iew2kahq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/240910-qc7xbsxala/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a9c8e2c9-58e9-4ca8-a6fa-97cc5e510043
Unpacked files
SH256 hash:
d4f439ea1344c2430ec5cc1f475eb76101f9879783a84a22ad072e9986bb24a6
MD5 hash:
ec0bdd3ea4851faf98d950c47a7f3ea9
SHA1 hash:
3b40a2674cf431b2b6b7d6e074c87875b25a146b
Link:
https://www.unpac.me/results/ccf95491-9653-4e76-a2b1-c694b06037ff/
SH256 hash:
d0738807a8ca9a085dc0268a8c48acc4d1f5e772ede77825846b6b3957a44d43
MD5 hash:
bb7cf5c7756c98e4ff237db55d5860a4
SHA1 hash:
bfb49e6655e81b48d76678146f4391b325585c4d
Link:
https://www.unpac.me/results/ccf95491-9653-4e76-a2b1-c694b06037ff/
SH256 hash:
8cdf7e716de26cf91167752202a426e1ba52756ffff52d30a576b1a412da500f
MD5 hash:
a65429f63b263bf8c9ff7e7fe8d5cd5b
SHA1 hash:
6018abfd31f0d875772edcee830c74f8be0d24eb
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/ccf95491-9653-4e76-a2b1-c694b06037ff/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8cdf7e716de26cf91167752202a426e1ba52756ffff52d30a576b1a412da500f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 8cdf7e716de26cf91167752202a426e1ba52756ffff52d30a576b1a412da500f

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::CopySid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::GetAce
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileExW
KERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
IPHLPAPI.DLL::IcmpCreateFile
KERNEL32.dll::CreateFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments