MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 baa42bc207ad525f7f285bf7c62fd5162db98b92cc5cb16ffd2a5737f5dc32d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 5

Intelligence 5 IOCs YARA 7 File information Comments

SHA256 hash:	baa42bc207ad525f7f285bf7c62fd5162db98b92cc5cb16ffd2a5737f5dc32d4
SHA3-384 hash:	78822d28c4c36b3261a800fb91f97125f19ff28854ab246469b4cbc64bc906f9564c4cc11ade52ca20e00f43fa12a91b
SHA1 hash:	59eb43fd44439d93ca02cbdc69d4c11d02558dd6
MD5 hash:	b075d3f78837ddef7292066e5956d467
humanhash:	friend-speaker-seventeen-leopard
File name:	Certificate 1045-20-11.rar
Download:	download sample
Signature	Formbook Create hunting rule
File size:	686'935 bytes
First seen:	2024-11-21 11:51:53 UTC
Last seen:	2024-11-21 15:11:52 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:9IvfPO+SyPnhgvDZezW8D1RexdJki4fXmKishZcvDDcxPzXgX9:+jPnMDZtqIxdWi4fdishyePkN
TLSH	T1DBE4234C04B7B5274D20326566DB8C20E2F1EF7E59F718D9F150AA12C9B33AF34A6C65
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	rar

cocaman

Malicious email (T1566.001)
From: "Billing <joe@ibaireland.org>" (likely spoofed)
Received: "from interesting-ramanujan.5-181-2-136.plesk.page (unknown [5.181.2.136]) "
Date: "21 Nov 2024 10:11:46 +0000"
Subject: "2nd Notification - 1st Certificate ready - 11/21/2024 10:11:36 a.m. ANNEX 2AL"
Attachment: "Certificate 1045-20-11.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Certificate 1045-20-11.exe
File size:	1'196'032 bytes
SHA256 hash:	f605d6db615c055fc80141bf79ab3f541303cf082244b352352bbd982a7aca50
MD5 hash:	374bfa99caf54477156253c18125cdc8
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=673f1fb01ff015366747b184

Tags:

autoit emotet

Gathering data

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/baa42bc207ad525f7f285bf7c62fd5162db98b92cc5cb16ffd2a5737f5dc32d4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/baa42bc207ad525f7f285bf7c62fd5162db98b92cc5cb16ffd2a5737f5dc32d4/

Threat name:

Script-AutoIt.Trojan.AutoitInject

Status:

Malicious

First seen:

2024-11-21 11:51:57 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

12 of 38 (31.58%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xkscxqqhvvjf67zilp34ml6vcyw3tc4szrolc375fjltp5o4glka._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/241121-qallbasmbw/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/baa42bc207ad525f7f285bf7c62fd5162db98b92cc5cb16ffd2a5737f5dc32d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)