MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b63ecc7941b1c62dc98d59344ec81a623276033f889fa43628010fc54030e100. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b63ecc7941b1c62dc98d59344ec81a623276033f889fa43628010fc54030e100
SHA3-384 hash: 055156ef0611c486a3fc4ad988435415a19682bdb4e7a504d2e1887ae90bb7bef9b716ab7f88d5385ad311cd0867fafd
SHA1 hash: 014c1d1873fbb5f18581b1da3414417bc55a5cc9
MD5 hash: 629b3cbb423e7b5b51f23a87b99a92e6
humanhash: chicken-sweet-yellow-king
File name:Shipping Document PL&BL Draft (1).exe
Download: download sample
Signature Formbook
Create hunting rule
File size:445'952 bytes
First seen:2021-02-12 21:51:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a57bcbf302bad83a90d00f7b978eade0 (2 x Loki, 2 x Formbook)
ssdeep 6144:Sr5w4udmLIY3llsUfFUlakZZlXV5VNIFdjSLjD9bHkXauTHmS0e901zp:mWSzbsckakZR5zqduLjpbE/K3d1p
Threatray 3'813 similar samples on MalwareBazaar
TLSH 4F94BE40B0C0903DF1694D326A99DB7211B97C727F597D4A6FE83F6A3A73CC0A65432A
Reporter GovCERT_CH
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Shipping Document PL&BL Draft (1).exe
Verdict:
Malicious activity
Analysis date:
2021-02-12 21:53:48 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/9cbea602-81c7-4634-a070-29eb23e6e5f0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117009/
Detection(s):
Sanesecurity.Rogue.0hr.20210122-0207.UNOFFICIAL
Create hunting rule

Win.Malware.Agen-9822494-0
Create hunting rule

Win.Malware.Mikey-9824612-0
Create hunting rule

Win.Malware.Mikey-9824683-0
Create hunting rule

PUA.Win.Adware.Bang5mai-6804572-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Unauthorized injection to a recently created process
Launching a process
Launching cmd.exe command interpreter
DNS request
Sending an HTTP GET request
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/607278
Signature
Antivirus detection for URL or domain
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 352669 Sample: Shipping Document PL&BL Dra... Startdate: 12/02/2021 Architecture: WINDOWS Score: 100 37 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->37 39 Multi AV Scanner detection for domain / URL 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 8 other signatures 2->43 10 Shipping Document PL&BL Draft (1).exe 1 2->10         started        process3 signatures4 53 Maps a DLL or memory area into another process 10->53 13 Shipping Document PL&BL Draft (1).exe 10->13         started        16 conhost.exe 10->16         started        process5 signatures6 55 Modifies the context of a thread in another process (thread injection) 13->55 57 Maps a DLL or memory area into another process 13->57 59 Sample uses process hollowing technique 13->59 61 Queues an APC in another process (thread injection) 13->61 18 explorer.exe 13->18 injected process7 dnsIp8 31 www.directorystar.asia 69.197.175.2, 49746, 49774, 80 WIIUS United States 18->31 33 mersinsudunyasi.com 89.252.185.4, 49752, 80 RADORETR Turkey 18->33 35 26 other IPs or domains 18->35 45 System process connects to network (likely due to code injection or exploit) 18->45 22 svchost.exe 18->22         started        25 autoconv.exe 18->25         started        signatures9 process10 signatures11 47 Modifies the context of a thread in another process (thread injection) 22->47 49 Maps a DLL or memory area into another process 22->49 51 Tries to detect virtualization through RDTSC time measurements 22->51 27 cmd.exe 1 22->27         started        process12 process13 29 conhost.exe 27->29         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b63ecc7941b1c62dc98d59344ec81a623276033f889fa43628010fc54030e100/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2021-01-22 00:51:43 UTC
AV detection:
29 of 29 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wy7my6kbwhdc3smnle2e5sa2mizhmaz7rcp2inriaeh4kqbq4eaa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
040e512b75bacd0ed6e0e13efa13f6ea92ebd47c214112b5371425009909c842
Formbook
0674ab6b81671be1eb9a4944f50ca24141a0034fa4d58b420e47506371db191b
Formbook
148007b32a311769a958c3f87c6c836b14457f17dbe6a9a0188b0f68b3c30b40
Formbook
196b4470cd98c4f6d5c634170a1c6a98cf59b61c9b12a032ec9fb776b74a0527
Formbook
444e72d12e85dffc1b247b29e7789022b251237f56ea83bf72e3c09fcb628874
Formbook
58b012a7c77564704af9bc88d272f1aa68c6789c84a146d0f566304c370bc89a
Formbook
5b895b1fe7b66a92588a06eba17a83022da0b539dd9c2eaafbf6082a656f7b57
Formbook
6ac9238d32f2a7b7315cdb2755e090aa53431a71d613e188209b02105e3b8af9
Formbook
bcba31709cecf79a6996bda8b48a9e891db6de827c852404634a96d248560ba3
Formbook
e7091e7da366f0b1d4acbc1295841c6f7d1ab9412a9fe3fd9341c9d94274c457
Formbook
+ 3'803 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:xloader loader rat spyware stealer trojan
Link:
https://tria.ge/reports/210212-wywqbkddhn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Xloader Payload
Formbook
Xloader
Malware Config
C2 Extraction:
http://www.elevatedenterprizes.com/h3qo/
Unpacked files
SH256 hash:
b63ecc7941b1c62dc98d59344ec81a623276033f889fa43628010fc54030e100
MD5 hash:
629b3cbb423e7b5b51f23a87b99a92e6
SHA1 hash:
014c1d1873fbb5f18581b1da3414417bc55a5cc9
Link:
https://www.unpac.me/results/597da5bc-2ae4-439f-b5d8-48bc1c5ba065/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/b63ecc7941b1c62dc98d59344ec81a623276033f889fa43628010fc54030e100

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_ransom_avaddon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Avaddon ransomware
Reference:https://twitter.com/VK_Intel/status/1300944441390370819
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

xz 70a5c6958a4955a582703ab85914ec72f29b80d4d368642f63b5d41cc52a0331

Formbook

Executable exe b63ecc7941b1c62dc98d59344ec81a623276033f889fa43628010fc54030e100

(this sample)

  
Dropped by
MD5 881473ad5b8376399f3df18ae371597f
  
Dropped by
SHA256 70a5c6958a4955a582703ab85914ec72f29b80d4d368642f63b5d41cc52a0331
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/117009/

Comments