MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 afbcc4589635ef9e83579c9865d99e7b454f827e5ae02b8248db0fc73d9553c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: afbcc4589635ef9e83579c9865d99e7b454f827e5ae02b8248db0fc73d9553c4
SHA3-384 hash: dcbeecafd84b5779b55ddf05757093c27c128f453223866dd8bf73910aed88bb63a5aa5428296354e3e055ec95cb4ac6
SHA1 hash: a491ba22cc0b212d40596b0e55c94cd91b21c1f3
MD5 hash: b3a6049df6caece43dfe7484f80519c4
humanhash: high-michigan-uncle-indigo
File name:FINAL SELECTION SAMPLE QUOTATION.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:634'880 bytes
First seen:2023-10-23 15:19:11 UTC
Last seen:2023-10-23 17:46:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:ozfqBAfWF5ImLXVo3BHl2hHmR/nt/UjxnOCNW8VIHxCkD:oT6GWFOmLFoRF2hHmBnVUNOf8VIHH
Threatray 358 similar samples on MalwareBazaar
TLSH T1A4D4125823A9D72ED4792FF68461E7A0CBF9F806A922D60A1CC510DD4B37FA45460FE3
TrID 61.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.1% (.SCR) Windows screen saver (13097/50/3)
8.9% (.EXE) Win64 Executable (generic) (10523/12/4)
5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon cccccccccccc3345 (17 x AgentTesla, 5 x Formbook, 1 x Loki)
Reporter cocaman
Tags:exe FormBook QUOTATION

Intelligence

File Origin
# of uploads :
63
# of downloads :
320
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
FINAL SELECTION SAMPLE QUOTATION.exe
Verdict:
Malicious activity
Analysis date:
2023-10-23 15:28:33 UTC
Tags:
formbook xloader
Link:
https://app.any.run/tasks/85932b9f-83a0-459b-81f8-59f1facdd0bb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/65368f244678fc28dfc65102/reports/402533e4-ddab-4296-9f43-5bbf2fb9685f/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/afbcc4589635ef9e83579c9865d99e7b454f827e5ae02b8248db0fc73d9553c4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2b297e73-36d2-4813-87a9-d0cc965320a1
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1330694
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/afbcc4589635ef9e83579c9865d99e7b454f827e5ae02b8248db0fc73d9553c4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/afbcc4589635ef9e83579c9865d99e7b454f827e5ae02b8248db0fc73d9553c4/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-10-16 00:55:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
24 of 38 (63.16%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v66miwewgxxz5a2xtsmglwm6pncu7at6llqcxasi3mh4opmvkpca._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
266e0c476f1988732a361461a4837386b72f215f5135033512c12bb3dde329c6
Formbook
50c55b209d899514903835fbded92e680b34cd34e24aac9d3919522c42b543d4
Formbook
5b6e037d89d37583717c2ac542e8f9e438cda7dd039ce042f2473a98b260716f
Formbook
5c81f8bdc8982d2a8dd77d0eaae816095fbfb73c9d11a7f82cb3ed005ba601d7
Formbook
696aaa0a2d06804fd98c3b16ae704eb779ddc833a6782fd289716dcf7fda35c8
Formbook
69823adb0ba288e8067ebfb8bb9377c8e86d336f70abb2186f86a306addca65b
Formbook
a94ee1fa20f2c027003ee0bef71045f2b0200eeb6511b621a599ab60f40f4b9f
Formbook
af9373c37ef6f7cee66f69230dd4bf6f7773153af373f3485a387c0856ef5dbc
Formbook
dfb9b3c7cf15baa877da2d2c87e1e53761517094bab2de1a6b92ebca122fa858
Formbook
+ 348 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/231023-sqqw3she61/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
043961098da7adb01104bfe078e0a9ba8ef1581c08c182bda7dbe321f9a2cbe8
MD5 hash:
70898a3cb1089c9bfead550b36b55d88
SHA1 hash:
9deebc8dad032b8c062744e0cc7f211d390c7c5d
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/6d42602f-d8f9-4192-a1ce-fb9d1988dccd/
Parent samples :
5aff1db8f4c749933cd8869e1e80f000e4c27de7c0c7a7d1aa59c4f324522210
6eeeec436d7abca44202ca9e5f3e20d2bc6a7f4adaf240e1ba5ab41e94890c29
8ee018d985fc1492a623c99ffdcd39c768a0cdeb975d791ebd3a1c372ff2128a
8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7
afbcc4589635ef9e83579c9865d99e7b454f827e5ae02b8248db0fc73d9553c4
SH256 hash:
eb3c14db4a7fe19d173136aed70921e64e0f45381a556f0f87ecb0f4f9ce8a8e
MD5 hash:
f95951ec1268bf89deb167d4ad8074c8
SHA1 hash:
f63707eea9536bddd0abb93683342b53c1e850a4
Link:
https://www.unpac.me/results/6d42602f-d8f9-4192-a1ce-fb9d1988dccd/
SH256 hash:
be4b62dde8ea819da76e898b0e64a7858be2e5f598233ed0d5474e0996db52b1
MD5 hash:
9aa83a0233f21419a96f5a1201adb4aa
SHA1 hash:
7fa0fe91070505550da96f11698259749ba824db
Link:
https://www.unpac.me/results/6d42602f-d8f9-4192-a1ce-fb9d1988dccd/
SH256 hash:
1ef4443878b6b4dece443767588df28b1ec9c6517317021ca05a2136414af0fe
MD5 hash:
1e191db81072a1bfc9350e5ef0d66c99
SHA1 hash:
34bae2bdef0a8cb3f6b51aefd75719dee29e74ea
Link:
https://www.unpac.me/results/6d42602f-d8f9-4192-a1ce-fb9d1988dccd/
SH256 hash:
0ca7e1e98517e30ed8c90b8af0b3a85b5669fec07cc50f44f5b8e0bf25768183
MD5 hash:
dbf0b8e07869bb1bf9bd00cc784a8cfc
SHA1 hash:
08e89207eda56a012422a37a2de481f227cebd89
Link:
https://www.unpac.me/results/6d42602f-d8f9-4192-a1ce-fb9d1988dccd/
SH256 hash:
afbcc4589635ef9e83579c9865d99e7b454f827e5ae02b8248db0fc73d9553c4
MD5 hash:
b3a6049df6caece43dfe7484f80519c4
SHA1 hash:
a491ba22cc0b212d40596b0e55c94cd91b21c1f3
Link:
https://www.unpac.me/results/6d42602f-d8f9-4192-a1ce-fb9d1988dccd/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj e45e050839b17e21868dcd7e07c4f3ac4cf94fe727f51c6e958b680739e5f23b

Formbook

Executable exe afbcc4589635ef9e83579c9865d99e7b454f827e5ae02b8248db0fc73d9553c4

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 e45e050839b17e21868dcd7e07c4f3ac4cf94fe727f51c6e958b680739e5f23b
  
Dropped by
MD5 b8374940215d019e8690b9d9362ad745

Comments