MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 99dfa5a36a438daadbbfd9c087e5a005287e5a2b25668ba57a7e78d34b1c3b0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 9
| SHA256 hash: | 99dfa5a36a438daadbbfd9c087e5a005287e5a2b25668ba57a7e78d34b1c3b0b |
|---|---|
| SHA3-384 hash: | 6b84192d246466ed24155a1846affed8c8d788d14a400fcc5914ac7cb879b678552e91d42f40d06ce66625dbe9aac354 |
| SHA1 hash: | 4e387d8e24c09e3cb230396cc9d19ec440160d61 |
| MD5 hash: | 9adc00f6d3ebe3969f229d7898d8338f |
| humanhash: | foxtrot-robert-florida-six |
| File name: | INV-DHL.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 412'606 bytes |
| First seen: | 2022-02-03 11:58:15 UTC |
| Last seen: | 2022-02-03 12:27:52 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla) |
| ssdeep | 6144:5wOXv3kMLrYtJg7goBXcyIJErMgL9k2oOKZiixuIV+97WmOIJO5xtqa20XAYm:l/vHgJugQMTJEwWMOK4Ii9GIJO5u4X9m |
| Threatray | 13'244 similar samples on MalwareBazaar |
| TLSH | T103948BB2E1F144D5D826C6701967AD2122F76E6DDCF84209EABFB72597B22C3305780B |
| File icon (PE): |  |
| dhash icon | e39688020b0a2436 (1 x Formbook) |
| Reporter |  lowmal3 |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
185
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
Launching a process
Сreating synchronization primitives
Launching cmd.exe command interpreter
DNS request
Searching for synchronization primitives
Setting browser functions hooks
Searching for the window
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Threat name:
Win32.Trojan.FormBook
Status:
Malicious
First seen:
2022-02-03 08:29:25 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
17 of 27 (62.96%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 13'234 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Loads dropped DLL
Unpacked files
SH256 hash:
d98ec63d3f10382fb973110b64818f1a38c5f19be437e1606507c0cfa3ad8760
MD5 hash:
1914bae3abaaf3d20ebd5351fa0c5d4f
SHA1 hash:
b2f64eef79bff1b7e07a03aa3769bf518e164e75
SH256 hash:
99dfa5a36a438daadbbfd9c087e5a005287e5a2b25668ba57a7e78d34b1c3b0b
MD5 hash:
9adc00f6d3ebe3969f229d7898d8338f
SHA1 hash:
4e387d8e24c09e3cb230396cc9d19ec440160d61
Malware family:
FormBook
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.