MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b624f2628a187644b398db22269d178207461ea7180bc442b3623a0ec67d35f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
FormBook
Vendor detections: 4
| SHA256 hash: | b624f2628a187644b398db22269d178207461ea7180bc442b3623a0ec67d35f2 |
|---|---|
| SHA3-384 hash: | 62f385291757d2728cf07f42e6cf1504afeb89450c29efc8ff96316f0188d07a82b8e9f6cf95603eb3a20830916d5460 |
| SHA1 hash: | 4e5662a50cc145921b1cbfc7b1786c546f0250b5 |
| MD5 hash: | ff1e4620d26fd3222185c63beeb2cb8c |
| humanhash: | ohio-yankee-july-network |
| File name: | PO 96355.pif |
| Download: | download sample |
| Signature | FormBook |
| File size: | 1'107'968 bytes |
| First seen: | 2020-03-27 11:05:04 UTC |
| Last seen: | 2020-03-27 12:39:16 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 217063d80133b7d89cb9ef54f0d88bea (1 x FormBook) |
| ssdeep | 24576:xHK8Pfu4sQnLSyIErZGOoc7+7vKzDUo7e471E3:5jfu4xLzRoOocgvKzDB7b1 |
| Threatray | 2'205 similar samples on MalwareBazaar |
| TLSH | F335D022B690D471D4B2027687BBD7F15B3CBE110B2982C776D43AAC9E345E2B639317 |
| Reporter |  cocaman |
| Tags: | FormBook pif |
Intelligence
File Origin
# of uploads :
2
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Noon
Status:
Malicious
First seen:
2020-03-27 02:53:22 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
36 of 48 (75.00%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 2'195 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| AUTH_API | Manipulates User Authorization | ADVAPI32.dll::AllocateAndInitializeSid ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW ADVAPI32.dll::FreeSid ADVAPI32.dll::SetEntriesInAclA ADVAPI32.dll::SetNamedSecurityInfoW ADVAPI32.dll::GetSecurityDescriptorSacl |
| DNS_API | Performs DNS calls | DNSAPI.dll::DnsRecordSetCompare DNSAPI.dll::DnsRecordSetCopyEx |
| SECURITY_BASE_API | Uses Security Base API | ADVAPI32.dll::ImpersonateLoggedOnUser ADVAPI32.dll::SetSecurityDescriptorDacl ADVAPI32.dll::SetSecurityDescriptorSacl |
| WIN32_PROCESS_API | Can Create Process and Threads | KERNEL32.dll::CreateProcessA ADVAPI32.dll::OpenProcessToken KERNEL32.dll::CloseHandle |
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA |
| WIN_BASE_EXEC_API | Can Execute other programs | KERNEL32.dll::WriteConsoleA KERNEL32.dll::WriteConsoleW KERNEL32.dll::SetConsoleCP KERNEL32.dll::SetConsoleOutputCP KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleOutputCP |
| WIN_BASE_IO_API | Can Create Files | KERNEL32.dll::CreateDirectoryA KERNEL32.dll::CreateFileA KERNEL32.dll::DeleteFileA KERNEL32.dll::GetWindowsDirectoryA KERNEL32.dll::GetFileAttributesA KERNEL32.dll::GetTempFileNameA |
| WIN_REG_API | Can Manipulate Windows Registry | ADVAPI32.dll::RegOpenKeyExA ADVAPI32.dll::RegQueryValueExA |
| WIN_SCARD_API | Supports Windows Smart Card | WinSCard.dll::SCardGetProviderIdW |
| WIN_SVC_API | Can Manipulate Windows Services | ADVAPI32.dll::ControlService ADVAPI32.dll::CreateServiceA ADVAPI32.dll::OpenSCManagerA ADVAPI32.dll::OpenServiceA ADVAPI32.dll::QueryServiceConfigA ADVAPI32.dll::QueryServiceStatus |
| WIN_USER_API | Performs GUI Actions | USER32.dll::FindWindowA USER32.dll::CreateWindowExA |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.