MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 af16c852a919a985ef1bc1a6f004104112e572d691948afe4c6a496b1b9ab6f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | af16c852a919a985ef1bc1a6f004104112e572d691948afe4c6a496b1b9ab6f0 |
|---|---|
| SHA3-384 hash: | a26aaac7b53ee8f2c0e4b3111640a011ca3c8bcc48a6155e1548b5f6c486973d149404fd181d444bece3b2d8f0dd0caf |
| SHA1 hash: | e5c07db0dfa2eecb848131ee702ec2df408e7b20 |
| MD5 hash: | 671c417da43176bf5ed787059f578f51 |
| humanhash: | salami-early-carpet-seventeen |
| File name: | 671c417da43176bf5ed787059f578f51 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 247'109 bytes |
| First seen: | 2022-03-31 10:05:08 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 56a78d55f3f7af51443e58e0ce2fb5f6 (719 x GuLoader, 451 x Formbook, 295 x Loki) |
| ssdeep | 6144:HNeZmUB7qeXGjJEGVUA5BpODlAjiHLGh6CP4SmS94oYdw0a:HNlURqeXOJhayfOxAWy6NXSLMs |
| TLSH | T14134128823E4C19BC5D359343C7E7A675BEA9E028444931F23607B4CBE77641A95F38B |
| File icon (PE): |  |
| dhash icon | b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching a process
Сreating synchronization primitives
Launching cmd.exe command interpreter
Searching for synchronization primitives
Sending a custom TCP request
DNS request
Setting browser functions hooks
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Detection:
formbook
Threat name:
Win32.Trojan.Woreflint
Status:
Malicious
First seen:
2022-03-31 10:06:06 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
23 of 25 (92.00%)
Threat level:
5/5
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook campaign:j37e rat spyware stealer suricata trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Formbook Payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
67acfedd68af88fb3c481626185b8856817861c68dc658b56b1559d16820954e
MD5 hash:
f9a244255dfd955df71bd5efea8156d9
SHA1 hash:
7394fd41914e11d1b8e2ca04d3803d8b3a37fe4a
SH256 hash:
a50e91a0ce22c1f3a1334925d8adb61912258cef1a881cefda7343a2f6922ebf
MD5 hash:
154fe134b82fe92fb56d73e27f0d3b0f
SHA1 hash:
8fdca7101a35c905ff845648fbdd6f9a1403bd70
SH256 hash:
da6dfc55001f1cf3cf91be517e8604c210fd29fa70682a19a29071be4588332a
MD5 hash:
a4bec6151c3ebaed0cafed589847a5b8
SHA1 hash:
64e75b2ae3deed59ac3b3f875dac05d871eaaca9
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
af16c852a919a985ef1bc1a6f004104112e572d691948afe4c6a496b1b9ab6f0
MD5 hash:
671c417da43176bf5ed787059f578f51
SHA1 hash:
e5c07db0dfa2eecb848131ee702ec2df408e7b20
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://192.210.149.28/604/vbc.exe