MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 914197cf527a9ba99649acce5d2482eab0b0558d060cbb1e12d4273f82f4f9b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	914197cf527a9ba99649acce5d2482eab0b0558d060cbb1e12d4273f82f4f9b4
SHA3-384 hash:	d80adeed65796d737f6114497ce37b8f65ae8efb94dd5ec5d07555d15e1a751e99e29f1288a95f21e290e769268a4eab
SHA1 hash:	ca752f76ae8cea215798d67a2b470cb9a82d2bf4
MD5 hash:	32ec9af7623d83ab63db6a92247e3b5c
humanhash:	montana-paris-lemon-uncle
File name:	niceworkfornicepeopleswhoknowmewell.hta
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	133'219 bytes
First seen:	2024-10-17 08:03:09 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	48:7oagpd7Ah23jX0IVK3yIFUZAwIVK3fiIFUZAL0KtGrGyRWYCM6mxTpyLnFHMwzXk:Eam73rCPiykYbx9KnFH9iB9RfMy57T
Threatray	35 similar samples on MalwareBazaar
TLSH	T13FD3B2A2E93449ECB7CC8E937EFD339D322A172F975A2E92835B3802DC5571D429091C
Magika	txt
Reporter	abuse_ch
Tags:	FormBook hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

89

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Obfus-95.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6710c4f61d4ef219fa63a7b9

Tags:

Powershell Gumen

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/914197cf527a9ba99649acce5d2482eab0b0558d060cbb1e12d4273f82f4f9b4/results/dashboard

Payload URLs

URL

File name

http://104.168.7.23/888/pictureofgoodthingsofgreatthingsof.tIF

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6710c4fab8693873ac8318a4/reports/7e92c18d-9c40-4a18-8fcd-2ca34fa4cdf5/overview

Hybrid Analysis VBS.Asthma.2.ED3CB0DA

Verdict:

Malicious

Labled as:

VBS.Asthma.2.ED3CB0DA

Link:

https://www.hybrid-analysis.com/sample/914197cf527a9ba99649acce5d2482eab0b0558d060cbb1e12d4273f82f4f9b4

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Joe Sandbox Cobalt Strike, FormBook

Result

Threat name:

Cobalt Strike, FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1535795

Signature

AI detected suspicious sample

Bypasses PowerShell execution policy

Detected Cobalt Strike Beacon

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Obfuscated command line found

PowerShell case anomaly found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected AntiVM3

Yara detected FormBook

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/914197cf527a9ba99649acce5d2482eab0b0558d060cbb1e12d4273f82f4f9b4

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/914197cf527a9ba99649acce5d2482eab0b0558d060cbb1e12d4273f82f4f9b4/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Asthma

Threat name:

Script-WScript.Trojan.Asthma

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-10-17 03:09:53 UTC

File Type:

Text

AV detection:

6 of 38 (15.79%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sfazpt2spkn2tfsjvthf2jec5kylavmnayglwhqs2qtt7axu7g2a._file

Threatray formbook

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

Similar samples:

26e4a01c3bef96ae60bfd385f66f8b2ecf9facc57f1090c293ba9376b93610d0

Formbook

85ddce242c61e8681d46c8cec3b98d58e29ea1e7c5dc4ca8316fa089d31fede9

Formbook

88f27894e72aa124ede3ca1b1c1de506bfe1faddbe03915ec4cd6dfd4c58c7b6

Formbook

8fbf6165b0751a47bf9842011e82c4a7715cc879fd7272b45ab549df6e813e46

Formbook

9204167d6ee4e10d7aa2668b1d1cd356c0049053c3a0afff80558309ae842f25

Formbook

d9c7fa0a03560078e3eb0a61d42cafd68ee7c90da0ca06ca83bc05bab596f7c6

Formbook

dd95ad614d09e77335120d4e10cf4af0ae5dc3e4c8ab8cf80646f121e7f8a793

Formbook

ec3da458946fc4aeaf736cf364034b54c07cae1526bd9041567097eeb74fa355

Formbook

error

Formbook

ffbb35c5d13c55e016557f2d94a98f4fb22c5cd1c6391e355650218bbcf70011

Formbook

+ 25 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

defense_evasion discovery execution

Link:

https://tria.ge/reports/241017-jx94vsyfmf/

Behaviour

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Evasion via Device Credential Deployment

Malware Config

Dropper Extraction:

https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg%20

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/914197cf527a9ba99649acce5d2482eab0b0558d060cbb1e12d4273f82f4f9b4