MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b0ebf928b4df7f41c89599e1e1320fb1d44e36e1d5a3055b376c82b912fdf182. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 12
| SHA256 hash: | b0ebf928b4df7f41c89599e1e1320fb1d44e36e1d5a3055b376c82b912fdf182 |
|---|---|
| SHA3-384 hash: | d8bf4552a909b214074838752759ab7a06a57faa9b4842ee304216ea97994c30de0003c956f334900df72fe607accd4c |
| SHA1 hash: | 21e15dce234723f3524b82884b325532faa0aaa9 |
| MD5 hash: | 39e8e017213ac49d53a0a7cfe411b9e3 |
| humanhash: | three-fix-ink-yankee |
| File name: | 39e8e017_b0ebf928b4df7f41c89599e1e1320fb1d44e36e1d5a3055b376c82b912fdf182 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 734'208 bytes |
| First seen: | 2023-05-23 12:25:55 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'471 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:4TZx0YPX/NqPs6ofpGyBlFTbZMgjeYogXRoRwfb+ksOLXT05N8aPRSUKhGL3:4TsHPszY4TbxjYbe+Is5NLPR6EL |
| Threatray | 2'903 similar samples on MalwareBazaar |
| TLSH | T124F4F1C12A984D14E6AB5FB949B3F27453757C61EF23C74A28E42C8BBC66A413B017D3 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | 224472b2a0c04280 (13 x AgentTesla, 10 x Formbook, 8 x Loki) |
| Reporter |  pmmkowalczyk1111 |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
281
Origin country :
PLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
39e8e017_b0ebf928b4df7f41c89599e1e1320fb1d44e36e1d5a3055b376c82b912fdf182
Verdict:
No threats detected
Analysis date:
2023-05-23 12:26:36 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Trojan.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AveMariaRAT
Status:
Malicious
First seen:
2023-05-22 19:55:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
19 of 23 (82.61%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'893 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
417fc8ab93a27f65e32dafe3e7d926abb7404347551e453b26b548131d92666f
MD5 hash:
b617f14c27a47042b2f20dfbc0d80271
SHA1 hash:
bf747ac5bc5860b6e8555c2bab3b7a0626c16c2c
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
a1b41c2a552cd9f101766b837d6461f873f9fe0afbf9657303d30c8fab34195f
MD5 hash:
bf9c1b3acaa327a06c77419f0ad49860
SHA1 hash:
50cb5befa24cbeca6555448d7b4b78600102696d
SH256 hash:
478bc0791cb455f1a75a600928572e052d9852c20a6763e550995ad46bbd5e9c
MD5 hash:
ad885c22e76481f6906be9541f136391
SHA1 hash:
e56f9b7576a144f24314d34db1a379b1aafcefc1
SH256 hash:
4c7ce432433fc3a8b0a33d558e0041d3f1c222224c5e61f33104d990a534c7a4
MD5 hash:
e8d756b4e2de5a67446e0b1b80e1bb99
SHA1 hash:
b664448f87ac044a16706d35e5d76538ba79508a
SH256 hash:
cf4b93fada50fb62fa52b32931b69e1badb9026aa3272310db4b1f8809c813eb
MD5 hash:
3a4448c5c95e9df90ccb367534bcb20c
SHA1 hash:
6830e3d7002531c0eacbd86e20c7b3bf46f7c7da
SH256 hash:
583abe7cf9d23804de162b72368fe4aaf1f81333f565a2aee706e6db681e76db
MD5 hash:
49b45e53d1213c6cdc56b3b9ea6f9881
SHA1 hash:
18adc138dc57765c6e0f43d2241b1a5c8e2ae483
SH256 hash:
b0ebf928b4df7f41c89599e1e1320fb1d44e36e1d5a3055b376c82b912fdf182
MD5 hash:
39e8e017213ac49d53a0a7cfe411b9e3
SHA1 hash:
21e15dce234723f3524b82884b325532faa0aaa9
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.