MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 95398256c9a457e155671d2b4eb69b688c151002a1b58abd0de1411690a53c88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 7
| SHA256 hash: | 95398256c9a457e155671d2b4eb69b688c151002a1b58abd0de1411690a53c88 |
|---|---|
| SHA3-384 hash: | 3c629b41d74059ac770c1f791ecb96ac7b1c5ae1f07822d647289a91ce2abec1d03fec269eb78fdb3e4c52a37de61d2f |
| SHA1 hash: | fcdd594ba56c26fcb57b4e8c44d63905f2472701 |
| MD5 hash: | 092fa3d9ecece2d4422a00cfd4722fda |
| humanhash: | oklahoma-avocado-oscar-edward |
| File name: | New Order & Product Specifications.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 488'448 bytes |
| First seen: | 2020-10-07 04:47:01 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger) |
| ssdeep | 6144:GSi5Za+LKfq5sLfnvKWbhpKYVNxEWOI4JOdQCw5uRlItyw9C8j1Ppvu00:GSivlLBiLXKOuY3xfzMulDetyl8O |
| Threatray | 163 similar samples on MalwareBazaar |
| TLSH | EDA4AD736C82989ECE6947B10CB541F1F67A02CE3F938A0E72AE530C0E11757775A66E |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
abuse_ch
Malspam distributing unidentified malware:HELO: fujitec.co
Sending IP: 209.11.159.147
From: Purchase Dept <mohan.j@fujitecindia.com>
Subject: Fwd: Product Enquiry/New Order
Attachment: New Order Product Specifications.iso (contains "New Order & Product Specifications.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Sending a UDP request
Creating a window
Launching the default Windows debugger (dwwin.exe)
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Signature
.NET source code contains very large array initializations
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Status:
Malicious
First seen:
2020-10-07 03:36:39 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 153 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Unpacked files
SH256 hash:
9e711e7d6d9a8f0cb54f0c83eb74ad7cb09f33310996cc7ad85f49907d65f0a3
MD5 hash:
d5b54f0f0fe63d9d0a9d2d608e158c6a
SHA1 hash:
52cab4fc7e5aac5f9784affd348a3f87afe498c7
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
SH256 hash:
107a05e8af1cc369ecee89a96c74b22853e41a4317da4104a935aff540f00bc6
MD5 hash:
8cf053299816b322c2df3cc6e81f3778
SHA1 hash:
1928220bce46db32735df8531089ef7c5bfaac90
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
05de1d5105c66dbb10ae9862992f84017d133e7e29b6ff36200df39f99dbf69e
MD5 hash:
a5ab9e9951ae9d5f44c9cc7f3a2e8321
SHA1 hash:
904ae3f482288f1008d5c67b6a39e693c3244a0d
SH256 hash:
2b6859c0a174527f5d375b65a883d0418258d2e77f76d42b9fa7840933cacbc7
MD5 hash:
fa824f366d2eead8e0cae2354993aaf1
SHA1 hash:
c0d7f191445c3cda294633a3b816bf56ad79fc09
SH256 hash:
be241808f30545f79b19f301f5b5ed9af41e7c63db78bed842b4718329d02884
MD5 hash:
96856d427a4bf136643a029e083fbb64
SHA1 hash:
f1397f7bd13445d29a84f498540ab424c324573d
SH256 hash:
95398256c9a457e155671d2b4eb69b688c151002a1b58abd0de1411690a53c88
MD5 hash:
092fa3d9ecece2d4422a00cfd4722fda
SHA1 hash:
fcdd594ba56c26fcb57b4e8c44d63905f2472701
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.