MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94c082ec29d284b51c37637f7032140d138533a9c0e79c1de8f99b3511948a4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94c082ec29d284b51c37637f7032140d138533a9c0e79c1de8f99b3511948a4a
SHA3-384 hash: 1dc025c247b63c17f6fd2ac5a18f1567e62cfd94eb91cd36801b8e7add583779d8f036d37f3b85a67d49d7fb8c1e6cd2
SHA1 hash: bb4fad9ca434f25809723bc79905c5b264a9d2e2
MD5 hash: cb7245f821aaa97b8e6493e5cc5a8596
humanhash: virginia-juliet-oxygen-wyoming
File name:Shipping-Document.img
Download: download sample
Signature Formbook
Create hunting rule
File size:360'448 bytes
First seen:2023-01-31 09:29:05 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:WYa6TgoxfclokC7mu8QzFbwHSZBjzDGH6tLJfU2gIB7vZpf+b:WY2oxfKt9u86tzDGG+27TZpg
TLSH T1587402086185C167D4E206F049342A7F66E2EE12A4B5D7173369BF087F77B01AA0B3B3
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:DHL FormBook img Shipping


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL International <finqueries@shipping-dhl.com>" (likely spoofed)
Received: "from mg1.eee.tw (mg1.eee.tw [43.254.16.244]) "
Date: "Tue, 31 Jan 2023 01:30:01 +0800"
Subject: "DHL AWB & Shipping Document"
Attachment: "Shipping-Document.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Shipping-Document.exe
File size:305'850 bytes
SHA256 hash: b2edb64ef798a43a9135ba4d0fea509e72e7d640bcc7e64cfe6b6203a4b1d837
MD5 hash: dc61611fc32d4cf284569fac59a6df05
MIME type:application/x-dosexec
Signature Formbook
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.Variant.Lazy.263633.3492.3604.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
context-iso overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63d8df9c447edb203a023bb1/reports/d7c18ff0-44fd-405a-abda-7766e29b9108/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94c082ec29d284b51c37637f7032140d138533a9c0e79c1de8f99b3511948a4a/
Threat name:
Win32.Trojan.Lazy
Create hunting rule
Status:
Malicious
First seen:
2023-01-31 09:30:07 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
11 of 39 (28.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=staif3bj2kclkhbxmn7xamqubujykm5jydtzyhpi7gntkemurjfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/94c082ec29d284b51c37637f7032140d138533a9c0e79c1de8f99b3511948a4a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:SUSP_EXE_in_ISO
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:Internal Research
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.formbook.
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 94c082ec29d284b51c37637f7032140d138533a9c0e79c1de8f99b3511948a4a

(this sample)

Formbook

Executable exe b2edb64ef798a43a9135ba4d0fea509e72e7d640bcc7e64cfe6b6203a4b1d837

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b2edb64ef798a43a9135ba4d0fea509e72e7d640bcc7e64cfe6b6203a4b1d837
  
Dropping
Formbook
  
Dropping
MD5 dc61611fc32d4cf284569fac59a6df05

Comments