MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1347714d02fd4e8d61bb36d2559ecfc692417fd743df8a59d961fe42c6b1ac7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1347714d02fd4e8d61bb36d2559ecfc692417fd743df8a59d961fe42c6b1ac7
SHA3-384 hash: f65ff3332d0714aa81c85522555815e1254c95a4de6273c104ef263b93b28fd6c304fc61bd87028e3df3f2c1cdcce151
SHA1 hash: f64c6724cf94781136307cace8f7fd3f5a762034
MD5 hash: 6b8699718f72b9ab820a060e616955d0
humanhash: charlie-magazine-princess-jig
File name:İŞLEM ÖZETİ_524057699-1034 nolu TICAR.xlsx.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:906'240 bytes
First seen:2024-06-11 19:30:06 UTC
Last seen:2024-06-11 20:32:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:0g61jjk0LAta9AUDIDsHD7kJ6qUDk0spGhDeq+g92ze:wksjQJmkWh6q+rz
Threatray 11 similar samples on MalwareBazaar
TLSH T16F15D01173B8099FE6BE9BFA04104254CB753B1AB6BED3ED1CC9B0CD59F1B209A51A43
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter abuse_ch
Tags:exe FormBook geo TUR

Intelligence

File Origin
# of uploads :
2
# of downloads :
344
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b1347714d02fd4e8d61bb36d2559ecfc692417fd743df8a59d961fe42c6b1ac7.exe
Verdict:
Malicious activity
Analysis date:
2024-06-11 20:58:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ca1905cd-7aa7-4e00-a4a5-3e26ac267b43

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Packed2.46843.32395.9335.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6668a9ad5c0e232c1ff0538bwin7simulatehigh_evasion
Tags:
Banker Encryption Execution Stealth Trojan Heur Dexter
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b1347714d02fd4e8d61bb36d2559ecfc692417fd743df8a59d961fe42c6b1ac7
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b66e4dbb-a217-410e-9e18-c3ed937734e9
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1455544
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Double Extension File Execution
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses shutdown.exe to shutdown or reboot the system
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1455544 Sample: #U0130#U015eLEM #U00d6ZET#U... Startdate: 11/06/2024 Architecture: WINDOWS Score: 100 43 www.fungusbus.com 2->43 45 www.deviexp.com 2->45 47 2 other IPs or domains 2->47 51 Snort IDS alert for network traffic 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 10 other signatures 2->57 10 #U0130#U015eLEM #U00d6ZET#U0130_524057699-1034 nolu TICAR.xlsx.exe 4 2->10         started        signatures3 process4 file5 39 #U0130#U015eLEM #U... TICAR.xlsx.exe.log, ASCII 10->39 dropped 61 Adds a directory exclusion to Windows Defender 10->61 63 Injects a PE file into a foreign processes 10->63 14 #U0130#U015eLEM #U00d6ZET#U0130_524057699-1034 nolu TICAR.xlsx.exe 10->14         started        17 powershell.exe 23 10->17         started        19 dllhost.exe 7 10->19         started        21 #U0130#U015eLEM #U00d6ZET#U0130_524057699-1034 nolu TICAR.xlsx.exe 10->21         started        signatures6 process7 signatures8 65 Maps a DLL or memory area into another process 14->65 23 XxXpTWyYPutpZLxR.exe 14->23 injected 67 Loading BitLocker PowerShell Module 17->67 26 conhost.exe 17->26         started        28 WmiPrvSE.exe 17->28         started        process9 signatures10 59 Found direct / indirect Syscall (likely to bypass EDR) 23->59 30 shutdown.exe 13 23->30         started        process11 signatures12 69 Tries to steal Mail credentials (via file / registry access) 30->69 71 Tries to harvest and steal browser information (history, passwords, etc) 30->71 73 Maps a DLL or memory area into another process 30->73 75 Queues an APC in another process (thread injection) 30->75 33 XxXpTWyYPutpZLxR.exe 30->33 injected 37 firefox.exe 30->37         started        process13 dnsIp14 41 parkingpage.namecheap.com 91.195.240.19, 49716, 80 SEDO-ASDE Germany 33->41 49 Found direct / indirect Syscall (likely to bypass EDR) 33->49 signatures15
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b1347714d02fd4e8d61bb36d2559ecfc692417fd743df8a59d961fe42c6b1ac7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b1347714d02fd4e8d61bb36d2559ecfc692417fd743df8a59d961fe42c6b1ac7/
Threat name:
ByteCode-MSIL.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2024-06-11 08:04:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
53
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=we2hofgqf7korvq3wnwskwpm7rusif75oq67rjm5syp6ildldldq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0ed75cc87008a5c3fc4b70fccabd2856cc16d062d9103ad5f587bec92c58cea0
Formbook
58fb2eef2cb867a0316df7cd3d833333dc48653eb2c9e1f639c9f749ec39f265
Formbook
8d08bbacab44a273fd8b281833abce7549708199dee895246185c13acbb40c3b
Formbook
9d104a1c57250458263ee33927332afc8f052457ba1ac4a7318bcafd148e68fb
Formbook
aa667be19c861a59464088524698c0097d5d8a461bae61f3c5c99b4fcaef4838
Formbook
d0b94b855d2f24add1edf6b3a6ecae24e4366f181a1ccd0bcd3b27e94de95bc0
Formbook
+ 1 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution
Link:
https://tria.ge/reports/240611-x8bbkaydmh/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/bb86d47a-fb83-4232-ab02-cd47fd8a2f8a
Unpacked files
SH256 hash:
983b34e832d5c59a579cfca1ebd79d7e3bc4e23ae599b989b9d5eb93edffec97
MD5 hash:
3300707f36d479433f23a3436a280b06
SHA1 hash:
4943e5ceeadc0837fa772dab71fcf2115a77e25e
Link:
https://www.unpac.me/results/8ff3e5c0-65aa-4d07-9c55-bf43c075ecb7/
SH256 hash:
6c930aafb95d521a2f65142afb27527cb07492258b8e520b81388758b4ad066d
MD5 hash:
d50c22df5bc525ae86fbe034324165d1
SHA1 hash:
1427f5d6976f909e69e7655dd12bcf47e2711648
Link:
https://www.unpac.me/results/8ff3e5c0-65aa-4d07-9c55-bf43c075ecb7/
SH256 hash:
0faa58f08a271c3a219ab697cdbde1aeca916d8a5d009fd1d18353fbc39f52f5
MD5 hash:
d231762b9243d28336a8f0c5e1ba1430
SHA1 hash:
f93ebde2ca1d364bc5c52e244898264c2346da31
Link:
https://www.unpac.me/results/8ff3e5c0-65aa-4d07-9c55-bf43c075ecb7/
SH256 hash:
d67867ef93204c27c126a41fa778fcdbf89e34a3750014d8cc4a9394a1300d96
MD5 hash:
cfddc0c2c035e91ecc76782ff513e30a
SHA1 hash:
efd2f376cd2a3574240be6b03c563f42630a6ef7
Link:
https://www.unpac.me/results/8ff3e5c0-65aa-4d07-9c55-bf43c075ecb7/
Parent samples :
82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8
804aee8eba800043c912038c55c36edeb8dd761913047e99b4a5e8d8cb8ef6c4
SH256 hash:
f582bc235d0881a394feaa81d074fe4f790f9abc32ea2fbedf845c138bbac1e4
MD5 hash:
2460daaa13ff7336116f637e42503499
SHA1 hash:
a63cb79355f024831953edd8972e1cea12d31dcc
Link:
https://www.unpac.me/results/8ff3e5c0-65aa-4d07-9c55-bf43c075ecb7/
SH256 hash:
b1347714d02fd4e8d61bb36d2559ecfc692417fd743df8a59d961fe42c6b1ac7
MD5 hash:
6b8699718f72b9ab820a060e616955d0
SHA1 hash:
f64c6724cf94781136307cace8f7fd3f5a762034
Link:
https://www.unpac.me/results/8ff3e5c0-65aa-4d07-9c55-bf43c075ecb7/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b1347714d02f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b1347714d02fd4e8d61bb36d2559ecfc692417fd743df8a59d961fe42c6b1ac7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments