MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e8dd0e9d0adac40a526531b51e77cd939d0d15f7d93fc6394d58d503b8ef8de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e8dd0e9d0adac40a526531b51e77cd939d0d15f7d93fc6394d58d503b8ef8de
SHA3-384 hash: 5b918a2db35fd45963f52723bfe97182fb536d3471c3f60aa672538ab2276000258d635aa4a2457a85f4b10540c8a140
SHA1 hash: 2ea186f765689a0129d13a50ee878bf38716c8eb
MD5 hash: 1ecdc67359e95446e3524287bf785475
humanhash: papa-table-black-avocado
File name:PO-230102_July 2023.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:309'844 bytes
First seen:2023-07-12 06:00:46 UTC
Last seen:2023-07-12 06:43:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep 6144:wYa60pd3UZYSK+Xn5hxCv2xl0WKrDUT1JkQ5joBg:wYSYYS95H90ZrDb0mg
Threatray 3'216 similar samples on MalwareBazaar
TLSH T1EF6412843BF9C872E6520271827696902EB09D362830DB0B5740B65EFDF66C29D1F377
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon fcd8d0d2dac0c0e4 (44 x Formbook, 1 x AgentTesla, 1 x XWorm)
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
248
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO-230102_July 2023.exe
Verdict:
Suspicious activity
Analysis date:
2023-07-12 06:02:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4e482482-d63f-4bd7-b424-6416ad47e105

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/416234/
Detection(s):
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.2055.31027.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a window
Creating a file
Unauthorized injection to a recently created process
Restart of the analyzed sample
Сreating synchronization primitives
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/97214/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/64ae41a3a15fc7eb4fd10f89/reports/25c14e11-90ab-486a-8c9e-a373914ede51/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/8e8dd0e9d0adac40a526531b51e77cd939d0d15f7d93fc6394d58d503b8ef8de
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d2ee5baf-0e64-4618-a4e2-ba68c76dcd11
Result
Threat name:
NSISDropper, FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1271417
Signature
Detected unpacking (changes PE section rights)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected FormBook
Yara detected NSISDropper
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e8dd0e9d0adac40a526531b51e77cd939d0d15f7d93fc6394d58d503b8ef8de/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-07-11 22:41:34 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
27 of 37 (72.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r2g5b2oqvwwebjjgkmnvdz343e45buk7pwj7yy4u2wgvao4o7dpa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2bd80ec646ac91c6c189040cdfa72d7bcef22d51daacea4bb7da7d3d5da5b034
Formbook
3e924b372c019c41e9995a276ce5c1b1487d14ceb9fbc8d606a09a83df5989b8
Formbook
56ed3fa85ad9bce9ba0d066676ea2386d9774f51bd341789e278a9dc9fa9256a
Formbook
6ad34b096097c2ad7be7db3178407c25b7b6d856dfbc8fe6e76b8e33aeaba80b
Formbook
7fa868c908374d9a48101bf8ed26b2f2c762773594106f176bd4ca279a91932c
Formbook
bd27f580c5a07f8ead5a2ead3ffa65e35e570e0d5e4e9acdc2292fdee9311cd1
Formbook
d99fdee30a323b0ed4cfbd9c4661530f45b368f829869604fb9a83debfff7a32
Formbook
ed970f5692d7a2e1fcf63f57635b45304d047c2d0f3b854dae2a39bff7e9707a
Formbook
+ 3'206 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230712-gqw8baca67/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Unpacked files
SH256 hash:
8e8dd0e9d0adac40a526531b51e77cd939d0d15f7d93fc6394d58d503b8ef8de
MD5 hash:
1ecdc67359e95446e3524287bf785475
SHA1 hash:
2ea186f765689a0129d13a50ee878bf38716c8eb
Link:
https://www.unpac.me/results/24ed231c-4710-4a14-8751-2daaa8d23ea1/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8e8dd0e9d0ad/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 8e8dd0e9d0adac40a526531b51e77cd939d0d15f7d93fc6394d58d503b8ef8de

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/416234/

Comments