MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e4936a8044f833fa8b5e67067208e8b81c0ca55844122013afe82a0af3b6eb6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e4936a8044f833fa8b5e67067208e8b81c0ca55844122013afe82a0af3b6eb6
SHA3-384 hash: 5f9ae560f9c628f2945ce02df1c9bdbf0778c122126ffc9109b3eddcf3c2761918760ee488ed1a0662390d9cec7689cf
SHA1 hash: 54d5d783279109aca3abb09354aa99f02fc0994b
MD5 hash: 6b0f9cfb69941d168fef11869e4c42b9
humanhash: pennsylvania-sixteen-east-oxygen
File name:satın alma emri pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'158'656 bytes
First seen:2023-03-03 17:05:03 UTC
Last seen:2023-03-03 18:32:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:j9dh2f8JfV2CeDzuPNy3k1aBH4fxQvy4:hdh2EJfB0zuPNykwt4JWy4
Threatray 7 similar samples on MalwareBazaar
TLSH T1A835872808FD0EF285B1F1FDDFD4E753BE8088E6AA049D9982834B89555395720AFD3D
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 0060696971696000 (10 x AgentTesla, 3 x Loki, 3 x Formbook)
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
223
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
satın alma emri pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-03-03 17:05:51 UTC
Tags:
formbook xloader trojan stealer
Link:
https://app.any.run/tasks/d556898f-76df-44f7-b298-216958186a10

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/371497/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Launching a process
Creating a process with a hidden window
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/640228c22ea6b369663094ea/reports/eeb7219b-4feb-450e-b81f-1e916f760f5a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/8e4936a8044f833fa8b5e67067208e8b81c0ca55844122013afe82a0af3b6eb6
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9df9e3a6-3c28-409c-98ad-999cd6d7cb0e
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1186729
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 819606 Sample: sat#U0131n alma emri pdf.exe Startdate: 03/03/2023 Architecture: WINDOWS Score: 100 58 www.spicyappleshop.com 2->58 60 spicyappleshop.com 2->60 78 Snort IDS alert for network traffic 2->78 80 Malicious sample detected (through community Yara rule) 2->80 82 Antivirus detection for URL or domain 2->82 84 8 other signatures 2->84 11 sat#U0131n alma emri pdf.exe 7 2->11         started        15 KWWHHQhTOU.exe 5 2->15         started        signatures3 process4 dnsIp5 50 C:\Users\user\AppData\...\KWWHHQhTOU.exe, PE32 11->50 dropped 52 C:\Users\...\KWWHHQhTOU.exe:Zone.Identifier, ASCII 11->52 dropped 54 C:\Users\user\AppData\Local\...\tmpCAFE.tmp, XML 11->54 dropped 56 C:\Users\...\sat#U0131n alma emri pdf.exe.log, ASCII 11->56 dropped 92 Writes to foreign memory regions 11->92 94 Allocates memory in foreign processes 11->94 96 Adds a directory exclusion to Windows Defender 11->96 18 RegSvcs.exe 11->18         started        21 powershell.exe 21 11->21         started        23 schtasks.exe 1 11->23         started        68 192.168.2.1 unknown unknown 15->68 98 Multi AV Scanner detection for dropped file 15->98 100 Machine Learning detection for dropped file 15->100 102 Injects a PE file into a foreign processes 15->102 25 RegSvcs.exe 15->25         started        27 schtasks.exe 1 15->27         started        file6 signatures7 process8 signatures9 70 Modifies the context of a thread in another process (thread injection) 18->70 72 Maps a DLL or memory area into another process 18->72 74 Sample uses process hollowing technique 18->74 76 2 other signatures 18->76 29 explorer.exe 1 18->29 injected 33 conhost.exe 21->33         started        35 conhost.exe 23->35         started        37 conhost.exe 27->37         started        process10 dnsIp11 62 www.leveldhealth.com 185.53.179.171, 49701, 80 TEAMINTERNET-ASDE Germany 29->62 64 www.polopoo.net 45.199.29.205, 49700, 80 DXTL-HKDXTLTseungKwanOServiceHK Seychelles 29->64 66 3 other IPs or domains 29->66 104 System process connects to network (likely due to code injection or exploit) 29->104 39 WWAHost.exe 29->39         started        42 colorcpl.exe 29->42         started        44 autofmt.exe 29->44         started        signatures12 process13 signatures14 86 Modifies the context of a thread in another process (thread injection) 39->86 88 Maps a DLL or memory area into another process 39->88 90 Tries to detect virtualization through RDTSC time measurements 39->90 46 cmd.exe 39->46         started        process15 process16 48 conhost.exe 46->48         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e4936a8044f833fa8b5e67067208e8b81c0ca55844122013afe82a0af3b6eb6/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-03-03 15:48:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rzetnkaej6bt7kfv4zygoieoroa4bssvqraseaj272bkblz3n23a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
10f07d893ce971191295d3c52b3a5c761b62edde3a50981cafb2ffc5fab72dab
Formbook
5bdac8b30125850db84f9c3dceee1dfbbbc67e1ca5501cf678e14b835f38000c
Formbook
90f8a6e23c16788ef3a7adee0b9b9a03cede0905367d71a8be46d3dc24b7b759
Formbook
edf9df1a661fc13c4773ac176efe0381a60a04e829e338fdbcab37b5b45170e2
Formbook
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:md25 rat spyware stealer trojan
Link:
https://tria.ge/reports/230303-vlt42sae88/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Formbook payload
Formbook
Unpacked files
SH256 hash:
7af3ca997814ed2b4a01702dfe56276094f9a2f654c665efcc159d18960dac18
MD5 hash:
c0ba5883a7a40e79a899bc57e349d36a
SHA1 hash:
e8c0c7117f60e08cb4b643b60aa5cc3cd16a9283
Detections:
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/30b6aad9-93cf-4f17-aa6f-7c7c6ae66b26/
Parent samples :
10f07d893ce971191295d3c52b3a5c761b62edde3a50981cafb2ffc5fab72dab
edf9df1a661fc13c4773ac176efe0381a60a04e829e338fdbcab37b5b45170e2
8e4936a8044f833fa8b5e67067208e8b81c0ca55844122013afe82a0af3b6eb6
ced21302bfa069209473ff66c3511ee8530a11a5323db0b485acb12d6a88a188
SH256 hash:
1bab001c090f2f208e39247f8eeaeb77a0740bc9be7fa755cd57a863b3d22dd3
MD5 hash:
90b3109cf9cc5342015fc1583a78b282
SHA1 hash:
bdddff1c96296a0dc9f8d808e3b2d5829a15d2d2
Link:
https://www.unpac.me/results/30b6aad9-93cf-4f17-aa6f-7c7c6ae66b26/
SH256 hash:
b10de2bef5d9727388b0b32d3f3610ce8b2030bd695a5100a15c708a794e8376
MD5 hash:
95362b31004c272e28fa39bac0622e1a
SHA1 hash:
730ada82808da41de98179f02f490af4fa913985
Link:
https://www.unpac.me/results/30b6aad9-93cf-4f17-aa6f-7c7c6ae66b26/
SH256 hash:
763f61ea9dd80f4bc2263b870566f18d9febff60d41d15f3a8afaabb4f8adf1d
MD5 hash:
d5dea0a67a4e2fa15d1e4a58273113b0
SHA1 hash:
47f5687d06e428ff0e4c8fb4fe4bb76eef16131a
Link:
https://www.unpac.me/results/30b6aad9-93cf-4f17-aa6f-7c7c6ae66b26/
SH256 hash:
e386840537170219177c2bb3404f4c7bd9da1a2d53cdf2ae1e857c3b19628a29
MD5 hash:
d170ab8c03b9c37d5be449454db131d2
SHA1 hash:
2031b6754a65d21b47dd11a34fee86f048d6048d
Link:
https://www.unpac.me/results/30b6aad9-93cf-4f17-aa6f-7c7c6ae66b26/
SH256 hash:
8e4936a8044f833fa8b5e67067208e8b81c0ca55844122013afe82a0af3b6eb6
MD5 hash:
6b0f9cfb69941d168fef11869e4c42b9
SHA1 hash:
54d5d783279109aca3abb09354aa99f02fc0994b
Link:
https://www.unpac.me/results/30b6aad9-93cf-4f17-aa6f-7c7c6ae66b26/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8e4936a8044f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8e4936a8044f833fa8b5e67067208e8b81c0ca55844122013afe82a0af3b6eb6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 8e4936a8044f833fa8b5e67067208e8b81c0ca55844122013afe82a0af3b6eb6

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/371497/

Comments