MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6719029029e5c7a96005dbb17e6eeea26a1af0d1b0e090a4041d24cba3923f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6719029029e5c7a96005dbb17e6eeea26a1af0d1b0e090a4041d24cba3923f7
SHA3-384 hash: 3900e946126d050893eec61a09048cbe05aee50fc35381bd95dc81a6a8c9f961fd03037c19d3d227b93ca850051d9829
SHA1 hash: c8a9c7b5be0d279ce522c2176f92342d4d4e9830
MD5 hash: a5c3c7bc08be513832d1f5eb9f4a76c0
humanhash: shade-maryland-diet-six
File name:SOA.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'219'584 bytes
First seen:2024-09-10 07:59:25 UTC
Last seen:2024-09-10 08:58:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash bbac62fd99326ea68ec5a33b36925dd1 (46 x AgentTesla, 38 x njrat, 27 x Formbook)
ssdeep 24576:34lavt0LkLL9IMixoEgeaxrn6W+SAftL7qUq9MmCS:Skwkn9IMHeaxrn6W+VLaPCS
TLSH T1EE45C00373DDC3A5C3725133BA25BB41AEBB7C2506A1F59B2FD9093DE920162921E673
TrID 63.7% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
11.6% (.EXE) Win64 Executable (generic) (10523/12/4)
7.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
5.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter cocaman
Tags:exe FormBook Shipping

Intelligence

File Origin
# of uploads :
3
# of downloads :
436
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SOA.exe
Verdict:
No threats detected
Analysis date:
2024-09-10 08:00:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/06746f45-8ff7-4571-a05e-ca2452f7723d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen1.28882.24832.12963.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66dffc8576bc4542b0495219
Tags:
Inject
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/b6719029029e5c7a96005dbb17e6eeea26a1af0d1b0e090a4041d24cba3923f7
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fbb612bd-ee34-441f-8cf5-6c2f6ff6a84e
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1508490
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b6719029029e5c7a96005dbb17e6eeea26a1af0d1b0e090a4041d24cba3923f7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b6719029029e5c7a96005dbb17e6eeea26a1af0d1b0e090a4041d24cba3923f7/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2024-09-10 07:59:32 UTC
File Type:
PE (Exe)
Extracted files:
27
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wzyzakictzohvfqalw5rpzxo5itkdlyndmhascsaihjezorzep3q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/240910-jvz6watbnp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2be90e36-dc55-4156-884a-ff5eb3c621d5
Unpacked files
SH256 hash:
65ff9daaa822949b47a9a9582b568367f84061b35c9d0c3d79b737d8076dbdce
MD5 hash:
78b6fc3d6a498eb65e99342a52e8386b
SHA1 hash:
9ff0f89b853b26b14f955557921340851feb05de
Detections:
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
Link:
https://www.unpac.me/results/97fa7b69-040b-48bf-b51b-a063083cd204/
Parent samples :
c675bb6df91d54c34b1cd975463415c5232cba63a76371c588359e01a2445370
b6719029029e5c7a96005dbb17e6eeea26a1af0d1b0e090a4041d24cba3923f7
72837dda6a46fef393a6420f045e6ae543908430d3a09fe8d4bfb6f6679c5b53
b2506989b1e8d1fee6174708d5f92776dfdda091a7244ab2e01f189180c72059
f3f0ac7ba7b93d8571adfa54987fb7374451f863b44946202bc623a528fc5b5f
b3c5c896606eb408bd97f255b916cda8cf8aa4291c3f68c5108c9ff0f5b7c0b7
9009393f8bbee65f3ba8ed3a6559a3dd7329d59ad2f4ae2043c06cd8f41d5e1e
ed3017e6c19e4afa7e7c20b6b63bcdc4a617274252af227aecbf8e15ca272dba
SH256 hash:
3ff85c7d19641b334803f9228a171d4a28b5ba9c81a7fcd979bcbeec4886be8a
MD5 hash:
b46e2bffd0945101989a826a738e8da1
SHA1 hash:
cf2bfc6dd1230b41845ff38f3f1fa5e21cb440a0
Link:
https://www.unpac.me/results/97fa7b69-040b-48bf-b51b-a063083cd204/
SH256 hash:
b6719029029e5c7a96005dbb17e6eeea26a1af0d1b0e090a4041d24cba3923f7
MD5 hash:
a5c3c7bc08be513832d1f5eb9f4a76c0
SHA1 hash:
c8a9c7b5be0d279ce522c2176f92342d4d4e9830
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/97fa7b69-040b-48bf-b51b-a063083cd204/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b6719029029e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b6719029029e5c7a96005dbb17e6eeea26a1af0d1b0e090a4041d24cba3923f7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip ceb0ddcb659db1f720efa13e913e83df5d73bf277f2ddaabc3c046b825d6216d

Formbook

Executable exe b6719029029e5c7a96005dbb17e6eeea26a1af0d1b0e090a4041d24cba3923f7

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 ceb0ddcb659db1f720efa13e913e83df5d73bf277f2ddaabc3c046b825d6216d
  
Dropped by
MD5 9d8342d010a81b7cb2e0bbafa90d9c24

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::CopySid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::GetAce
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
IPHLPAPI.DLL::IcmpCreateFile
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments