MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 92770f64ffd8bd959b6dd9a052faba19f483b29bddc0904036896b62958abcdc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | 92770f64ffd8bd959b6dd9a052faba19f483b29bddc0904036896b62958abcdc |
|---|---|
| SHA3-384 hash: | 0b33a3b6d6a99610df315082c14e5750b352810fb7eec27129267d8614a1c02f9bdd143b491319edf62262fde95aa814 |
| SHA1 hash: | c54ad0cb61a49e0a28e41476ed8a36fc8e3b7a70 |
| MD5 hash: | 7340e3440038c266c66c23224a71fc72 |
| humanhash: | maine-mars-moon-sixteen |
| File name: | SecuriteInfo.com.Win32.PWSX-gen.4335.27687 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 737'792 bytes |
| First seen: | 2023-06-22 03:27:43 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger) |
| ssdeep | 12288:DVXpM1JCIQfNsVcuoQHH0s2TyNb8wwZtIFkkV/ivuGLarSefig/eYMmX8GwX:DI1KNov/6tf+SefigmYM1G |
| Threatray | 1'301 similar samples on MalwareBazaar |
| TLSH | T181F41210B76E1013C91B5FFD49A026B2073E759BB131D2DB0DCBB2AAE9A5F065A10B47 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | f0cce8c0e8f0d4e0 (9 x AgentTesla, 2 x Formbook, 2 x Loki) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
279
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.4335.27687
Verdict:
No threats detected
Analysis date:
2023-06-22 03:31:03 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Leonem
Status:
Malicious
First seen:
2023-06-22 01:28:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
23 of 36 (63.89%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 1'291 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
596fbee298702b05e8e9d0ef5ff52ae587f2aad12363d10291e34f52ed17f894
MD5 hash:
e1a21c1e9a97d9e1dd4564783ca28756
SHA1 hash:
92bf63acae5f224ec94660e191aa439a1de86220
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
23aad32f6bb90ff654c677b7a6208aaa6a353fc6dbe7b1f377fcc716df41a143
MD5 hash:
aad0f1e8041a9efba869bdb369dc1647
SHA1 hash:
2b2db700f16d0e9ef6a5bcab13b72a80234d8285
SH256 hash:
fdfa3349bbf0b3f7f24cdc2e6f29b34306376d65ccf58893a0e6f6158e6ba7bb
MD5 hash:
c187aeb5bdf17ed761c5f4bac7d7e221
SHA1 hash:
f59ae461710933272f6c0356d7dfab4c6ad75b7c
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
SH256 hash:
0160739cfd8d1897931f6821d701e3089c2bbd03d3ff8ed977ca4c618876b7e4
MD5 hash:
42fa7553572a0e8d2056a7c77597f57a
SHA1 hash:
c1beb634d03f733eedf2f2b4fc3ab14a4b388ae6
SH256 hash:
4df36fa47ce1780aa749e05ffdf158261d1bf45c4b155498cff64c18988b5112
MD5 hash:
0bcf4232e12b6a35fa5ff477aec2f878
SHA1 hash:
acbcc35f21517f0cc8f9c271c50ce8b3270b9be1
SH256 hash:
92770f64ffd8bd959b6dd9a052faba19f483b29bddc0904036896b62958abcdc
MD5 hash:
7340e3440038c266c66c23224a71fc72
SHA1 hash:
c54ad0cb61a49e0a28e41476ed8a36fc8e3b7a70
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.85
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.