MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a745c365d4721bd4ca52cc7caa356a3da3e80406b8f3cc9df2893550553dcaa9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | a745c365d4721bd4ca52cc7caa356a3da3e80406b8f3cc9df2893550553dcaa9 |
|---|---|
| SHA3-384 hash: | 9d3b9e31b9cc5dbd38e62950348d1b1d3da157fa8dfc1644e67f7c8054fdb86bebe7406b65e60069251a982bdd02a391 |
| SHA1 hash: | acaa1aee2d1d01d2d05f03a9ca98d8f32f0237eb |
| MD5 hash: | d9c7b401d89a0c698a7ef2cdc33416f6 |
| humanhash: | crazy-timing-georgia-beryllium |
| File name: | attached quotation.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 813'056 bytes |
| First seen: | 2024-12-03 13:05:42 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 12288:uhIR4R52J+XtHpraz0InsDjh23vWodpoaGAnBE3edbA0/3gR/9BCgNPXGQKaxDoX:uhIeeiyEgEaJnKudbXfo1BCWXGdaxjI |
| Threatray | 4 similar samples on MalwareBazaar |
| TLSH | T1F205F09C3611F44FC903C5354E70FDB4AA686DAA970393039ADB2EEFF81D9569E041E2 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| File icon (PE): |  |
| dhash icon | e44ad8ccc8a4a0c0 (22 x Formbook, 4 x RemcosRAT, 3 x AgentTesla) |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
388
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
attached quotation.exe
Verdict:
No threats detected
Analysis date:
2024-12-03 13:43:13 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Verdict:
Malicious
Score:
90.9%
Tags:
virus gates micro
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Malware family:
KeyBase
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Signature
.NET source code contains potential unpacker
AI detected suspicious sample
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Backdoor.FormBook
Status:
Malicious
First seen:
2024-12-03 07:41:30 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
25 of 38 (65.79%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
unknown_loader_037
Result
Malware family:
n/a
Score:
5/10
Tags:
discovery
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
d838d1193c74347cf4aee3e17f4fc7b20607bc746c0e22097e9854476a5929c7
MD5 hash:
6a49cc3f4b1e740a7e7b6517a908c79e
SHA1 hash:
58a62e71de01e5ac3be242cb67fd9284c136c420
Detections:
win_formbook_g0
SH256 hash:
f6e801540b0efe1b0c57a4b85d5d6371df9e1f4e01b651423f40763144f67b82
MD5 hash:
e2a54de967eb34b5f61e8359232716f2
SHA1 hash:
0986e4c6310d7652217e9ba0310ef76ed387af4a
SH256 hash:
48c1416f6b6a61e1ee051b1987025186fe016a1d5c75cb6d9e17df41bb420271
MD5 hash:
53ca009966e183fb017ed0ce402cb19d
SHA1 hash:
b4ef2c1fde4997ea0c8a3f0492605680df2a6b21
SH256 hash:
63d2df68cd149c02915e2bd2bb4200bd53d73f16c5ba2c626faf2350da5628da
MD5 hash:
8ff7be2fe684f03ac6474d981a0facff
SHA1 hash:
9b9a54ffe1f878a6f526a2e2ea1e13ec975de6b3
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
acf09c80699691d3a6a8d52577d06a7054c1bda1953a55527251e92e15ba037f
MD5 hash:
69473b5123488cff4aae599aa14eb3a4
SHA1 hash:
1d3562fd2fb55582cb97441b9f01065dd80373fc
SH256 hash:
a745c365d4721bd4ca52cc7caa356a3da3e80406b8f3cc9df2893550553dcaa9
MD5 hash:
d9c7b401d89a0c698a7ef2cdc33416f6
SHA1 hash:
acaa1aee2d1d01d2d05f03a9ca98d8f32f0237eb
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.