MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a20fa4193eed761f19b7fd7abca68d837d1a93df5bfff216573fddb830999f10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 11
| SHA256 hash: | a20fa4193eed761f19b7fd7abca68d837d1a93df5bfff216573fddb830999f10 |
|---|---|
| SHA3-384 hash: | 1cd5aeb185bf8a82fad746d85912029a311f79f1b99d8f8145bb0d5052aa3ad4629057139a5b2102e79c947acb1f4d42 |
| SHA1 hash: | 4a295c538b447abb6771b69e038a656348ee9219 |
| MD5 hash: | 113c9a888c85a77b5b63093dc058ce59 |
| humanhash: | oxygen-eleven-johnny-comet |
| File name: | SecuriteInfo.com.MSIL.GenKryptik.GOZC.tr.26607.1046 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 722'432 bytes |
| First seen: | 2023-12-05 06:28:55 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger) |
| ssdeep | 12288:Ol5nF8uVdqrlbg6tS8BORPwmKJquwAbiLJJApFgBLGGo5z57n:Ol/qhbETPwmKw3JJAkoGA |
| Threatray | 20 similar samples on MalwareBazaar |
| TLSH | T1FEE4239761D8AEABE0BD9B365039910113F600A70252FF1F4EC6D9CA4F8FF584622767 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 0060696969716800 (8 x AgentTesla, 6 x Formbook, 2 x Loki) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
325
Origin country :
FRVendor Threat Intelligence
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
masquerade packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-12-05 06:29:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
15 of 23 (65.22%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 10 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
0e176b7d62bc092e0b292fde00a67aa319efe43b0efa6c1dd5ca23246d0e1e6f
MD5 hash:
5784d7a2eb41c2971586a6dc5c99f8e2
SHA1 hash:
8a2e5fe1b8c74e705075584f0ce045de14d0abb8
SH256 hash:
785a0588e30995ac06df2eeb24bb03ba193b271d77cbc1963ee0a9f33dbfcfde
MD5 hash:
088d94682dd1b92ddb6d7adb05271956
SHA1 hash:
50bba80ce1cab30755e5a2c57a405b2299d542b3
SH256 hash:
4a35390eaa5a0b63a425e13d7f9cc53c434974518588b90db938c68fd4bd4cd4
MD5 hash:
a7f90e9b2e52a930225bf7348deb9646
SHA1 hash:
fe62a037af9e65a088b98591255e075d7fdf48ce
SH256 hash:
5ce8bcd264aef3b8a6b6350ad4d433203c2bb8487bc8c43126af281e930bb7ae
MD5 hash:
d1b836c7b77e043432f3158d2fec45fa
SHA1 hash:
8e5769d8d19a0bba8b73263f246db93267d22ac8
SH256 hash:
c34dfbc328de247d25d670c3b7853f1dddd2ec2607d5dbb0480743b45a15ea64
MD5 hash:
85b87384830444e6ab86a4a692ce96cc
SHA1 hash:
0d7d4614cf31d27e68ebf48e76fb1d308cc08152
SH256 hash:
a20fa4193eed761f19b7fd7abca68d837d1a93df5bfff216573fddb830999f10
MD5 hash:
113c9a888c85a77b5b63093dc058ce59
SHA1 hash:
4a295c538b447abb6771b69e038a656348ee9219
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DebuggerCheck__GlobalFlags |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Active |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Thread |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | Formbook |
|---|---|
| Author: | kevoreilly |
| Description: | Formbook Payload |
| Rule name: | maldoc_find_kernel32_base_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | maldoc_getEIP_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Windows_Trojan_Formbook |
|---|---|
| Author: | @malgamy12 |
| Rule name: | Windows_Trojan_Formbook_1112e116 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_formbook_w0 |
|---|---|
| Author: | @malgamy12 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.