MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 99508e1f259485c8c1a9b8a6b60c2fa9355caabd41e6c78854252cfa397673b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | 99508e1f259485c8c1a9b8a6b60c2fa9355caabd41e6c78854252cfa397673b7 |
|---|---|
| SHA3-384 hash: | 0dc1d798b964dcbd80e10b56c90c803ccde06bbf980ca8fe50bec3906a6fbc677317466eab5919d82c536998368b28f5 |
| SHA1 hash: | b0cb1a4336ccae6af11d5765aedd18c7e19cef6b |
| MD5 hash: | 0c8cebed7a44da9e131acb5a007c2dae |
| humanhash: | one-florida-music-connecticut |
| File name: | SecuriteInfo.com.MSIL.GenericKDS.61009645.tr.1588.646 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 699'392 bytes |
| First seen: | 2024-03-11 05:22:07 UTC |
| Last seen: | 2024-03-18 07:30:36 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 12288:QaX3inVFasf5tXz1xDZ0Czc4xofjw0mg5lVbhtn9P/9jJXeG5L7XKFey52wW1Kjh:N32HDR9z/HzzOfjw0milXlHJXeGV7XK5 |
| Threatray | 1'058 similar samples on MalwareBazaar |
| TLSH | T19BE4230CB625C474C6964E77A4285960D73D98A36502FECC3C1D88D8BED33788EE666F |
| TrID | 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4504/4/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| File icon (PE): |  |
| dhash icon | 69e8e8e8e8e8e869 (5 x Formbook, 5 x AgentTesla) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
9
# of downloads :
355
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
99508e1f259485c8c1a9b8a6b60c2fa9355caabd41e6c78854252cfa397673b7.exe
Verdict:
Suspicious activity
Analysis date:
2024-03-11 05:25:45 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Сreating synchronization primitives
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
masquerade packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
MSIL Injector
Verdict:
Malicious
Result
Threat name:
FormBook, PureLog Stealer
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
ByteCode-MSIL.Trojan.FormBook
Status:
Malicious
First seen:
2024-03-11 03:09:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
12 of 24 (50.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 1'048 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
78d6d8fd9900196806296a6f6ba9f6ff821e69761284ed08e4d2cb5ba68d5edd
MD5 hash:
c911ccbfe23a3f3835377090673f24d9
SHA1 hash:
da26b2a0c791df1ba9c21953567ce992997ddb08
Detections:
win_formbook_w0
win_formbook_g0
Parent samples :
d80d15764111eb80aa6f43d95f3effa13eb47c43937a578d78692769953defc0
0b635b5bcfdf7f115415cd72598cb387441cb7d0fcd2ad3937737fc01c05ca5c
d7eab9eb726b311e97b0c71522363b9223f767f7474c5cbf4d9bf0df9c4b909d
1c74b93b1aa4aaccbef0f11ab5466e2bb801a284b4c5d2d94d9c010b00931763
99508e1f259485c8c1a9b8a6b60c2fa9355caabd41e6c78854252cfa397673b7
0b635b5bcfdf7f115415cd72598cb387441cb7d0fcd2ad3937737fc01c05ca5c
d7eab9eb726b311e97b0c71522363b9223f767f7474c5cbf4d9bf0df9c4b909d
1c74b93b1aa4aaccbef0f11ab5466e2bb801a284b4c5d2d94d9c010b00931763
99508e1f259485c8c1a9b8a6b60c2fa9355caabd41e6c78854252cfa397673b7
SH256 hash:
b3f2bcb08ae6ed77b51186dc73ac27afc31c9e3b175914fbc7e932a053024057
MD5 hash:
8edcf081ada9f28a2722afb40ac6e099
SHA1 hash:
9a1d6568a6063fccac7eef51a12cbdaa81b82262
SH256 hash:
06a1ae787e808d6287de314be8bec64ef2e0d3bc1bf2ea71ae268c7b8fb19e2d
MD5 hash:
91b39e533d48f5fa25ac604da90b3d8d
SHA1 hash:
f5dadf1e8fcbe64609e4cd78a27e2810f7a6e69e
SH256 hash:
c8c1020fe926cc1851b73c1915ad32e2fc393dccb402782aca8f4ea6379ba84d
MD5 hash:
ef7cf89d9ec52b18a8f5b6ee49820f46
SHA1 hash:
dcf9cb9bb3f72ca4b3cc0c00b27bd9ce10b554bb
SH256 hash:
c10c9b0882bac6f788f48b4dabe3291b14e639e650f2b9fcb0bc174ac92ae02b
MD5 hash:
7c7fb6daa78beb69128991ff893143ed
SHA1 hash:
c01bb99984b12b84129db80eae1d5d8341a358e2
SH256 hash:
135fe5ca8243fb5a6f9ae3e5269f12161171183a8900104100e7bb6945fd781c
MD5 hash:
b3a7f4b2c2166867ce09979f26d6df54
SHA1 hash:
1f0c726c51db82bf3dcc47c92bb0c7d7b93144c5
SH256 hash:
56182131da00d157cdd1019360e270334907ef17f693910db6e04605b2cb4774
MD5 hash:
7f094129d22e75a28d7e156b5e68ed81
SHA1 hash:
bd1c36007ae8a2939101df78be38373414103ff8
SH256 hash:
22a50ecbba6cca6d90ecc335aa1719bbcb306069b58d805fbdd637babfd5dd6e
MD5 hash:
c66d0d4a7b452e9769e3a735df9a87b9
SHA1 hash:
a59baf7118c2e21d6f43799f71df439a561cfe00
SH256 hash:
38d3eb4fee4e67a0202c064d204da036b25b0b5ab5bdc6effc5862b4703834e7
MD5 hash:
6401583b7fcda12b03ee134ed242ebae
SHA1 hash:
7cf310d212eeec04876eef8fe45602a155bf933a
SH256 hash:
364fc1bb8e11bdda02cb466e1b54236f21f92398117abc7ba88208ffd5d55e18
MD5 hash:
e445dca2b3d7d647f76deda372054ea4
SHA1 hash:
5217a195ab840aaaf21b7204155eb163ef71a720
SH256 hash:
c0684901eaa3cc8342617cf8150b1df8bf87e58bd311c6d217072966e37a4f29
MD5 hash:
5c64cae97d8cc45ffd3261fe397f0ce4
SHA1 hash:
14577128ba60cefde394314f090fab32bea198b7
SH256 hash:
ca1d49c5a9c5d9c8e35327f2cf7dc550f0031318fbe29e8b0d5b18026e7ccac6
MD5 hash:
4af63eb975fea93b92707f68a9ba1f55
SHA1 hash:
1453d8bc7bc760a904fbe0897c7b6a0e0a287740
SH256 hash:
99508e1f259485c8c1a9b8a6b60c2fa9355caabd41e6c78854252cfa397673b7
MD5 hash:
0c8cebed7a44da9e131acb5a007c2dae
SHA1 hash:
b0cb1a4336ccae6af11d5765aedd18c7e19cef6b
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DebuggerCheck__GlobalFlags |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Active |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Thread |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | Formbook |
|---|---|
| Author: | kevoreilly |
| Description: | Formbook Payload |
| Rule name: | maldoc_find_kernel32_base_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | maldoc_getEIP_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Windows_Trojan_Formbook |
|---|---|
| Author: | @malgamy12 |
| Rule name: | Windows_Trojan_Formbook_1112e116 |
|---|---|
| Author: | Elastic Security |
| Reference: | https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach |
| Rule name: | win_formbook_w0 |
|---|---|
| Author: | @malgamy12 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.