MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 959d4d4b20048f42806546895bd45308d03049b3ba626fd4ec71ce77a0eb27ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 15
| SHA256 hash: | 959d4d4b20048f42806546895bd45308d03049b3ba626fd4ec71ce77a0eb27ac |
|---|---|
| SHA3-384 hash: | 91192d8e65e1a06220b03d17f754a61fb2d0a4b23b0517948949e2dee25145d0be8f65e26c67d6284528712036418690 |
| SHA1 hash: | 22bfb51c2d5519ffa964e40614bcb159696e6209 |
| MD5 hash: | 553509c1d98d259c93f99306ce733470 |
| humanhash: | uniform-zebra-lima-two |
| File name: | INQUIRY 3210015467654.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 821'760 bytes |
| First seen: | 2023-05-05 12:54:16 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:gBR390xPmaajtOAUYL4TIcnep4SbeavAKOC8aHYkGXN+GcWj2Nleg6:g10xuaajtfUYsccnU6oCaHiXNzzg6 |
| Threatray | 2'743 similar samples on MalwareBazaar |
| TLSH | T18305CF50F3B68902D50BCEB31A5CF9B011717C9B7DD08A6066E97F9B7BBBA44290064F |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  threatcat_ch |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
259
Origin country :
CHVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
INQUIRY 3210015467654.exe
Verdict:
Suspicious activity
Analysis date:
2023-05-05 11:37:01 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Trojan.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Signature
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-05-03 05:42:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
25 of 37 (67.57%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'733 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
656aada2ab9390504d7cf46b92d0393d234c3e85812f7f9973f50f17d752b189
MD5 hash:
20b79fb655ddb0e5e04635dced149c57
SHA1 hash:
9629333ca38b574db631577a0c541ae70c3f1f28
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
52fd88bb4e09230c87eb8c536ce9efb118a3ffe14bba30d16f879b96fe41c819
MD5 hash:
9b76023056ff0066e8eb2b99c325ae59
SHA1 hash:
1f8ac416222ad6f4842559346d18e594a0e445da
SH256 hash:
280001013946838a651abbdee890fa4a4d49c382b7b5e78b7805caef036304e2
MD5 hash:
d4b6893a5512534104c6c7403be60897
SHA1 hash:
d4b51c3e4cafb3b146435a4e2e21bb5ddf15956d
SH256 hash:
40c050c20d957d26b932faf690f9c2933a194aa6607220103ec798f46ac03403
MD5 hash:
c768bac25fc6f0551a11310e7caba8d5
SHA1 hash:
95f9195e959fb48277c95d1dd1c97a4edff7cb3a
SH256 hash:
f024cda00566de289cefdc8e470d7953a39ab83e99bbfc73edbf6318bb7f1dda
MD5 hash:
a01f310c3b7e4d80fed56705b0856a81
SHA1 hash:
4ac7c9677dd7fb1c09ef0bb214d8066457d9e61a
SH256 hash:
7347912af593bebcf540fa4b7cb93ba04c70d62ec0cdd67433362fa2751ccdd7
MD5 hash:
0a2b54d9075cdd0551f9d72d32347b88
SHA1 hash:
1dae588b6e657e059dcd1ea55600aca46a676fa1
SH256 hash:
959d4d4b20048f42806546895bd45308d03049b3ba626fd4ec71ce77a0eb27ac
MD5 hash:
553509c1d98d259c93f99306ce733470
SHA1 hash:
22bfb51c2d5519ffa964e40614bcb159696e6209
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.