MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b45a38f7012d02b12d3613d25450847d87c14c9b3207380594fc5e1f1b1728d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | b45a38f7012d02b12d3613d25450847d87c14c9b3207380594fc5e1f1b1728d9 |
|---|---|
| SHA3-384 hash: | e1214ffbd6796dfe42474851243495876e483e19adae7eef700c1faaa1b615795d7c03bad1c814ebb5c99b35fdaa6479 |
| SHA1 hash: | 719705903de481a3c680db18f8cef892efef3dc7 |
| MD5 hash: | 9e50ed09439b4f2206f6cee1b233677c |
| humanhash: | sad-coffee-network-steak |
| File name: | 9e50ed09439b4f2206f6cee1b233677c.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 522'240 bytes |
| First seen: | 2022-01-31 12:19:51 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:3VO7Ja3pyTw6uC3OfNP7sEaOA/4yycHHC53p:3VOVMyc9NlaOy4yvnCb |
| Threatray | 13'009 similar samples on MalwareBazaar |
| TLSH | T136B4AEB4A1A74695F40BC974657CF9B102B230E3A9C50D7823797601CFEEF683E85A4E |
| File icon (PE): |  |
| dhash icon | 8cfcd89cccc8d0b0 (23 x AgentTesla, 14 x Formbook, 4 x SnakeKeylogger) |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
181
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9e50ed09439b4f2206f6cee1b233677c.exe
Verdict:
Suspicious activity
Analysis date:
2022-01-31 12:40:13 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
DNS request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Detection:
formbook
Threat name:
ByteCode-MSIL.Trojan.Taskun
Status:
Malicious
First seen:
2022-01-31 12:20:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
19 of 28 (67.86%)
Threat level:
5/5
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 12'999 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook campaign:bt33 persistence rat spyware stealer trojan
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Sets service image path in registry
Formbook Payload
Formbook
Unpacked files
SH256 hash:
4f1532705d87c6986e6ee1427235d0ee9059cda1ed8d65d43c6be83eafba6aeb
MD5 hash:
4f89eed7ee99cfa1f0729c1c41039c6a
SHA1 hash:
2e017cec0c10f45d63e6cb1ea236d11df2693875
Detections:
win_formbook_g0
win_formbook_auto
Parent samples :
7cb0a06f7d34e3e89e90112768ff4a8c66897ea5a10a880c9aface1d544c3b2f
1c26112880679a9c6c7e310dedd154aa6e8afadf0117a8c1ff4bc53b2fd2ceda
c3e318eafb968f401d5165bb17e765613339ce25e4e48e99ea734580fae06d84
243bf6298e6d09d6b1defc371150fa5e0b34942eb6f2d616c187fa3fd7f44fbb
9e54c12e7b23d9988514b9aae1e3593b0a08814357860ff270f42014914b0a1e
1c0e03f910a70b5614f9b9b75ff74414a6bfd6f10d4f9bbd9dec78024f4da7bb
e9843d569f5bdca339208ffb80c5c0c9a92f20c85828d03b5cdfc9c37bbd598e
c6e101b1f3ef37505f4cae99303735cdbc09b0ef4f33f1d3f27742722e8276b4
b45a38f7012d02b12d3613d25450847d87c14c9b3207380594fc5e1f1b1728d9
0e8333bd57ef2ac051d65249e88b4fbc2e648951e5e417cc807bb9e23edffab1
1c26112880679a9c6c7e310dedd154aa6e8afadf0117a8c1ff4bc53b2fd2ceda
c3e318eafb968f401d5165bb17e765613339ce25e4e48e99ea734580fae06d84
243bf6298e6d09d6b1defc371150fa5e0b34942eb6f2d616c187fa3fd7f44fbb
9e54c12e7b23d9988514b9aae1e3593b0a08814357860ff270f42014914b0a1e
1c0e03f910a70b5614f9b9b75ff74414a6bfd6f10d4f9bbd9dec78024f4da7bb
e9843d569f5bdca339208ffb80c5c0c9a92f20c85828d03b5cdfc9c37bbd598e
c6e101b1f3ef37505f4cae99303735cdbc09b0ef4f33f1d3f27742722e8276b4
b45a38f7012d02b12d3613d25450847d87c14c9b3207380594fc5e1f1b1728d9
0e8333bd57ef2ac051d65249e88b4fbc2e648951e5e417cc807bb9e23edffab1
SH256 hash:
6f1b89bc3013177c101fe4448340c48c0dd08d19017a798bd11c2d0f76be1fbc
MD5 hash:
60a604887b3616e3ed86d81fab0a9ebb
SHA1 hash:
8db84f5f4c569c86c69aff464b2ffc4ce3dafa20
SH256 hash:
da8c9f4fdd49857daf86bce05684add16701b7c83b934756535bbaf7b7173f37
MD5 hash:
77e1c9da4374e816d4d89116da2e451e
SHA1 hash:
6cb51e2cec60038616c9171894bf184a84a6f1c0
SH256 hash:
b45a38f7012d02b12d3613d25450847d87c14c9b3207380594fc5e1f1b1728d9
MD5 hash:
9e50ed09439b4f2206f6cee1b233677c
SHA1 hash:
719705903de481a3c680db18f8cef892efef3dc7
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.