MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abb3fcb252b5c9e7aa022a3f16409b3f4b6dee5db0fe553b0cdda5ecc30eefad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: abb3fcb252b5c9e7aa022a3f16409b3f4b6dee5db0fe553b0cdda5ecc30eefad
SHA3-384 hash: b072fbaca0133248d0c19979810f31d2fac42441d0ae1236c3c3290243fcbc71a3aaac54a524cf9bd1547aa993cb6911
SHA1 hash: a5bfbef9a05bc24815637eaebcd958d81071d883
MD5 hash: 6983d9ebc21560ebe2d562d42cf43398
humanhash: november-freddie-quebec-blossom
File name:ISF DETAILS pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:605'696 bytes
First seen:2021-07-19 06:20:19 UTC
Last seen:2021-07-19 12:10:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:LOSV58SRQLAfKau1d6i5fWYaCQU3iIRZoVqsi0S+3Ukh7LpPLdaMyVXKp4EmKoY:LOSVmSOLAov6mW7CQU3iIRZoVqe3nB0B
Threatray 6'564 similar samples on MalwareBazaar
TLSH T1E0D4F1353318BBEED13AD77A94145D2467E0E123D327E21BFC6710EA5989EC28F62193
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
147
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ab.exe
Verdict:
Malicious activity
Analysis date:
2021-07-18 02:51:51 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/de900211-94d9-4746-804f-dbda47bf7385

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/172478/
Detection(s):
SecuriteInfo.com.Trojan.Siggen14.41699.9569.9691.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f2de382f-321c-49e3-b1ca-e2a7cfe16461
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/818066
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/abb3fcb252b5c9e7aa022a3f16409b3f4b6dee5db0fe553b0cdda5ecc30eefad/
Threat name:
ByteCode-MSIL.Trojan.Heracles
Create hunting rule
Status:
Malicious
First seen:
2021-07-18 00:24:56 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=voz7zmsswxe6pkqcfi7rmqe3h5fw33s5wd7fkoym3ws6zqyo56wq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0726096c82c2c643c7de2ed48533e0a545e71f2294433cd7df473aebe9f17681
Formbook
4c0c8cbb0e933f865862852967071eb6908bca3c610d2b14a77149d756db00fe
Formbook
7d0cc599bf46f1b454dc8a9c5abe86f6ba3c97032f153864513b98ccde3bc0cb
Formbook
92fee75dbfa7cb48d837b580cc3544832cf116d9991ac9cd0135cef22e535510
Formbook
9f1090c3e94e75b134c1aa55b5e8e2b6ac9b706cd27e0bb1cc44ef4b49f27c66
Formbook
c26154711ca9d9d48de370f242deb560bd0b99a0c8f12a2d1db5d4cd6e25d107
Formbook
d476f0d6936a06df598e0d45e9b80a4bc1e97880fd72351ecbde5fcb0dd2a96f
Formbook
ee3cd0b8ec089cdcec65b22189ecc9efb9f356afe0870e424cbdedcf19920e13
Formbook
+ 6'554 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210719-sp5jlb2n8s/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.valiantfinancial.net/hth0/
Unpacked files
SH256 hash:
c5a468677b7bc387a0f67d6f8badb1e4c26812a63a206ba2c004568a7fd953d5
MD5 hash:
3a6261137425bb8d7ffa6ca1a6ecfe4c
SHA1 hash:
e4331c5e2c61c3e5461b6c1e7106ffd200c83f4c
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/2737f1c9-e4ed-4278-8698-4254c8f7d622/
Parent samples :
d476f0d6936a06df598e0d45e9b80a4bc1e97880fd72351ecbde5fcb0dd2a96f
4c0c8cbb0e933f865862852967071eb6908bca3c610d2b14a77149d756db00fe
abb3fcb252b5c9e7aa022a3f16409b3f4b6dee5db0fe553b0cdda5ecc30eefad
48c48701e841f502a2b6740f73e15c20a1bc0d4b840c9f889f93638ac388d162
419d8b92dc042882bb3261de70dfe4a158bc9ca436c71f9bf330bb8a6917d04c
90e7c97ea4917a6efb5c0a69bd6f481b1a5023d6f8ad0f22d123c417edff8a68
SH256 hash:
2c577ac9b882b21855f08184a3a1f6ff885d8c528309023c275d1649bf3feeb0
MD5 hash:
e2991ce8dad7ebd568877f099bef8086
SHA1 hash:
bd8001edfd5afebb5dfef28833e11afa86db6a42
Link:
https://www.unpac.me/results/2737f1c9-e4ed-4278-8698-4254c8f7d622/
SH256 hash:
68f938c82a873cb8da51267e22f0a6199af30ae17561b1ade19f0188d618d084
MD5 hash:
85ce853e5e8384c0e91409b1aa8e9112
SHA1 hash:
ac038948b079c1b6b4bbfdda9152ad1986eab7d0
Link:
https://www.unpac.me/results/2737f1c9-e4ed-4278-8698-4254c8f7d622/
SH256 hash:
91ac545f8f696b1afd204eaf5641dbad04c6c2638905f1f1423d254877c77fee
MD5 hash:
3232956087e17949ce434250999daec4
SHA1 hash:
8a5c04cfbc980e94fd59f9692b48b0b29052282a
Link:
https://www.unpac.me/results/2737f1c9-e4ed-4278-8698-4254c8f7d622/
SH256 hash:
abb3fcb252b5c9e7aa022a3f16409b3f4b6dee5db0fe553b0cdda5ecc30eefad
MD5 hash:
6983d9ebc21560ebe2d562d42cf43398
SHA1 hash:
a5bfbef9a05bc24815637eaebcd958d81071d883
Link:
https://www.unpac.me/results/2737f1c9-e4ed-4278-8698-4254c8f7d622/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/abb3fcb252b5c9e7aa022a3f16409b3f4b6dee5db0fe553b0cdda5ecc30eefad

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe abb3fcb252b5c9e7aa022a3f16409b3f4b6dee5db0fe553b0cdda5ecc30eefad

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/172478/

Comments