MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a0944a8143c9b1520e9d4c27ba2a6699eafc3352c7fecee0039ab0f410b047ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | a0944a8143c9b1520e9d4c27ba2a6699eafc3352c7fecee0039ab0f410b047ff |
|---|---|
| SHA3-384 hash: | 65db949d35b704726f92caa22ea312d6d5ef0c0cb68279049ae32fecfa79cb643fc95c059d18c69cbc258ddaf844b115 |
| SHA1 hash: | b209fbab2c40928789c00f7fb4145a27c3f6857b |
| MD5 hash: | a7b354291ed6973453aafe52e7d50754 |
| humanhash: | music-nebraska-hydrogen-sierra |
| File name: | purchase order doc.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 601'600 bytes |
| First seen: | 2023-05-08 18:36:36 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:tRWbq9SZsqbAxSCXqsfvKGzx8D9OJWuUlB:OuL373xV8ZOg |
| Threatray | 2'749 similar samples on MalwareBazaar |
| TLSH | T1ADD4024432FA8FA2E9764BF40938B44207F134E759F5EA5C0EE561CA1AA7F001AD1F5B |
| TrID | 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4505/5/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Reporter |  threatcat_ch |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
323
Origin country :
CHVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
purchase order doc.exe
Verdict:
Suspicious activity
Analysis date:
2023-05-08 18:39:09 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Signature
.NET source code contains potential unpacker
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-05-08 11:42:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
17 of 24 (70.83%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'739 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
79ebbe5ccbc4bef9c07721cfaf0c733b4769382794482f40bff5967b7449a5be
MD5 hash:
98a5f3e48a3de289454230ea3acb45f4
SHA1 hash:
ed8dcd286132886bd0eeace8a46113d33ab55e85
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
42794e99927f4dcc692783444afee095e410e921b69e479662a68a304944bee2
MD5 hash:
e4a429836c5a555a001edb23b188e764
SHA1 hash:
fb776d6c6d15b54a8be1119ed96c8a4ff92875c5
SH256 hash:
6edb1c610ce66ff00516645c5a1022c39b326ebacf05136d51c1dc189503a291
MD5 hash:
fdfcec05c0201b1bce852af9b7be06e7
SHA1 hash:
f4db5c12d2513cdb930bce6d84320d3b1df24c82
SH256 hash:
a87664ac9d3c9edf5619b03808c5e074c0951d61fbaee5b23d2ce5ab9ca2a22a
MD5 hash:
ad5c537f24a6d0912ae37bee65cb9654
SHA1 hash:
e3517b06707a79f98d760c803db51f26eb75574f
SH256 hash:
76381217d4b07b099ffe8c8210053ad4ae6e54ccdf2082bf996ecbe9d66c6619
MD5 hash:
1803b08a45a43e6119e9369d1db04f73
SHA1 hash:
86fe7a321ddfa9c940ff19991f3a5249f562d91c
SH256 hash:
b52c29ba9ef8996bdf721950d900db96f1befb9883eb38c2075528e60c7aabd4
MD5 hash:
7b6143d9d94c8b80d191b77d8b6d1ba2
SHA1 hash:
1c91704ff6da2a9dd8aaa2ff2d5a5f69a445f76b
SH256 hash:
a0944a8143c9b1520e9d4c27ba2a6699eafc3352c7fecee0039ab0f410b047ff
MD5 hash:
a7b354291ed6973453aafe52e7d50754
SHA1 hash:
b209fbab2c40928789c00f7fb4145a27c3f6857b
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.