MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98af1f3c5432305b017b9d94ee5e4f7c9aef070f5cfbbcddda83f6ee7efce263. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 19


Intelligence 19 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98af1f3c5432305b017b9d94ee5e4f7c9aef070f5cfbbcddda83f6ee7efce263
SHA3-384 hash: cba69a878734653510f5f7d9aae0b9b1c45c854c17811882fff63a64b29c70443be966de6998f2089db5446f281da184
SHA1 hash: 350b493825a72e06cf61fc904deb4ab9987c2004
MD5 hash: 931796a49e91fab72ebf4478407b4f5e
humanhash: bluebird-virginia-robin-fanta
File name:23-QAI-OPS-0067 (7000000061)DOCS.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:278'462 bytes
First seen:2023-06-20 08:56:13 UTC
Last seen:2023-06-20 09:29:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep 6144:vYa6zJ3m9E+0sbpMbUNRO5c+/QXFl//Zc+vcZSOFgizi7:vY5Nm9wEeUNROEXFlnZ7EZ5F5O7
Threatray 2'317 similar samples on MalwareBazaar
TLSH T1E644120227EAC5DAC2F541F009389B9BAFF24D3130B9AD47676076AB3E376D2490D751
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter cocaman
Tags:exe FormBook RFQ

Intelligence

File Origin
# of uploads :
3
# of downloads :
283
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
23-QAI-OPS-0067 (7000000061)DOCS.exe
Verdict:
Malicious activity
Analysis date:
2023-06-20 08:58:58 UTC
Tags:
formbook xloader trojan stealer
Link:
https://app.any.run/tasks/18c40fc8-ef14-4668-a377-1f2b381066e0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/400942/
Detection(s):
SecuriteInfo.com.Gen.Variant.Nemesis.22782.7839.31424.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file
Unauthorized injection to a recently created process
Launching a process
Сreating synchronization primitives
Launching cmd.exe command interpreter
DNS request
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/91858/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
lolbin overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/649169df0f5b3414b1c80b92/reports/7b6bd31e-5148-432d-b3e9-c67d62d31413/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/98af1f3c5432305b017b9d94ee5e4f7c9aef070f5cfbbcddda83f6ee7efce263
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/262f5fea-941c-4e71-82ec-9f91f6455900
Result
Threat name:
FormBook, NSISDropper
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1258062
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Yara detected NSISDropper
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/98af1f3c5432305b017b9d94ee5e4f7c9aef070f5cfbbcddda83f6ee7efce263/
Threat name:
Win32.Trojan.Nemesis
Create hunting rule
Status:
Malicious
First seen:
2023-06-20 08:56:18 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
14 of 37 (37.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tcxr6pcugiyfwal3twko4xsppsno6byplt53zxo2qp3o47x44jrq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
142f8b22d894f1fee4c501acbc425edec276004d5d30ab7572cdfab85e89ad12
Formbook
1a28827929bbdf8fc02cbf542ae73de715c0b4b0e1be5c9484987ee44e652da1
Formbook
2e1feacb6a3980b6fe801af73c3eb68a60295d75e7a72fd0948091ba34a8d7d7
Formbook
3a5125b535a9d3aec7608c040173cea1e3c12cb855ec5bad90847406022dfe98
Formbook
4431648599d5c8d9ed6324d5cfaccf83daaecf91b9637b1cf308b8004ca43757
Formbook
9337bf26f7c97890b2d01df17d8c05158f37600b503d91fcc24b609643b03ce9
Formbook
99ec8b8e93e7a91dab1a16b9353333fa340d52569de4b88f5703bbc5a666211c
Formbook
f1a2809f94c92e79ee855d25fb1f0c369833fcceacceb6914051cddd9f767091
Formbook
+ 2'307 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:rx63 rat spyware stealer trojan
Link:
https://tria.ge/reports/230620-kwky1sba97/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Formbook payload
Formbook
Unpacked files
SH256 hash:
ffc6a21cdbd136645757843e68c45db85e6b6fedbe1fb77b5330d4bc78a6de02
MD5 hash:
e079599cd6ed9d3c748cd7443d9cc689
SHA1 hash:
6b30af38c1505f0f5a9a1c1d3c2ab93e638c4183
Detections:
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/84916f02-1293-4ab6-87eb-cd5ed0b3efd1/
Parent samples :
98af1f3c5432305b017b9d94ee5e4f7c9aef070f5cfbbcddda83f6ee7efce263
011765b154e93fd26afc6331fa7330996162cd8b9ae00c938a630e6bcca2cc0f
9bee385e9ed1fd5a2687089848845843ef58e463e1c7bb64c7c88436562dcd02
SH256 hash:
cc6b17ad40df561623c051c5125304a68543ae0bfb4b65f4d1c7f0284dc84c1f
MD5 hash:
b76d5cf1305a4bb70f46beb764ea556e
SHA1 hash:
0dc8fcb9cb89b68e6080dd95b97d2a1a16c5b8cc
Link:
https://www.unpac.me/results/84916f02-1293-4ab6-87eb-cd5ed0b3efd1/
SH256 hash:
98af1f3c5432305b017b9d94ee5e4f7c9aef070f5cfbbcddda83f6ee7efce263
MD5 hash:
931796a49e91fab72ebf4478407b4f5e
SHA1 hash:
350b493825a72e06cf61fc904deb4ab9987c2004
Link:
https://www.unpac.me/results/84916f02-1293-4ab6-87eb-cd5ed0b3efd1/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/98af1f3c5432/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/98af1f3c5432305b017b9d94ee5e4f7c9aef070f5cfbbcddda83f6ee7efce263

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj db39808e4c72472d6c8e8c1b4a0eb3c0000666aae739c606a11c65fdf612c545

Formbook

Executable exe 98af1f3c5432305b017b9d94ee5e4f7c9aef070f5cfbbcddda83f6ee7efce263

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 db39808e4c72472d6c8e8c1b4a0eb3c0000666aae739c606a11c65fdf612c545
Cape
Cape
https://www.capesandbox.com/analysis/400942/
  
Dropped by
MD5 6e1ccefeebb484f67302994fdc4b8747

Comments