MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 acf4a56d552865c24ed63e4a43e0c9f9e25c7bd1237539aeeb6a52bd55c31706. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 8

Intelligence 8 IOCs YARA 11 File information Comments

SHA256 hash:	acf4a56d552865c24ed63e4a43e0c9f9e25c7bd1237539aeeb6a52bd55c31706
SHA3-384 hash:	fae4bdf1b918888161f2773d206b932756bd5517393876ffb7139529fc93e9c568525049e55545ee57a331f5f8438c56
SHA1 hash:	cc22691a183284fd36df91f64b4046418df34af5
MD5 hash:	8bd421f37118e68ba920ee5e588a7328
humanhash:	florida-magazine-stream-utah
File name:	UPDATED DRAWING.zip
Download:	download sample
Signature	Formbook Create hunting rule
File size:	714'089 bytes
First seen:	2025-02-10 18:36:37 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:2PvBKnrz+uXjoFMR9mUaz7PXJvOdPv/qZ3Cz0jQiEbnSDhncqNSSRf+hRTvhd7l:I8GuTIMXs7Plm/43CQjQFWhncmVf+htl
TLSH	T1EAE423B87330F79C273FD2653CC69F10D95178928CE0ADAE26AE2AA9570D5719F0CD42
Magika	zip
Reporter	cocaman
Tags:	FormBook zip

cocaman

Malicious email (T1566.001)
From: "meng.zhiyuan@xinan-technology.com <meng.zhiyuan@xinan-technology.com>" (likely spoofed)
Received: "from xinan-technology.com (unknown [141.98.10.61]) "
Date: "10 Feb 2025 19:35:49 +0100"
Subject: "Re: BMTS_Geely Project Assessment_Class B_First Review"
Attachment: "UPDATED DRAWING.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

574

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	UPDATED DRAWING.exe
File size:	783'872 bytes
SHA256 hash:	979cecac7761f1c8cf74b514b38b637c15407b9def72c96814bec589a1d4618d
MD5 hash:	5db2d91120b758fcf94a52736b6b70df
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win32.MalwareX-gen.4745.12980.UNOFFICIAL

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67aa137cf667f46cd182d713

Tags:

virus micro msil

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/acf4a56d552865c24ed63e4a43e0c9f9e25c7bd1237539aeeb6a52bd55c31706/results/dashboard

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/acf4a56d552865c24ed63e4a43e0c9f9e25c7bd1237539aeeb6a52bd55c31706

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/acf4a56d552865c24ed63e4a43e0c9f9e25c7bd1237539aeeb6a52bd55c31706

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

8/10

Tags:

adware discovery persistence privilege_escalation stealer

Link:

https://tria.ge/reports/250210-xapfja1rhs/

Behaviour

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System policy modification

Uses Task Scheduler COM API

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Drops file in Program Files directory

Drops file in System32 directory

Suspicious use of SetThreadContext

Checks installed software on the system

Installs/modifies Browser Helper Object

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Boot or Logon Autostart Execution: Active Setup

Downloads MZ/PE file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/acf4a56d552865c24ed63e4a43e0c9f9e25c7bd1237539aeeb6a52bd55c31706

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Suspicious_Latam_MSI_and_ZIP_Files Create hunting rule
Author:	eremit4, P4nd3m1cb0y
Description:	Detects suspicious .msi and .zip files used in Latam banking trojan campaigns.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)