MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc3eeeaf4c3525845941625539abfe8a1f44190a739552b7f24a6bbf1b56f2a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bc3eeeaf4c3525845941625539abfe8a1f44190a739552b7f24a6bbf1b56f2a7
SHA3-384 hash: 785604a7104d250b61b66f4e1be4c17bfedfa4086d0911c3f33d34389a58fec7f46709b4add09a1fe2eaba64db6580f2
SHA1 hash: da1fffadb5cfcc43dc66c6eefa3d1dc7e90e4187
MD5 hash: 934f30b216d669f1fb9a6ddb99bff478
humanhash: bulldog-sixteen-football-lactose
File name:Nuovo ordine _WJO-002_pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:637'952 bytes
First seen:2022-05-12 15:45:33 UTC
Last seen:2022-05-12 16:49:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:TLQy3EL5Q9OPdNxwrnDFnOF8IbhpaU0/jclCV3Li09zDT:TstN1NxwrnoZbhpaUun3
Threatray 15'454 similar samples on MalwareBazaar
TLSH T17ED4925C7B414A72EC5D81386C130A157B521F332B8AFAD6279B3DDA87EF1E91C05C8A
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f9c9c9c8dcc1ce0c (13 x AgentTesla, 3 x Formbook, 2 x Loki)
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
275
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bc3eeeaf4c3525845941625539abfe8a1f44190a739552b7f24a6bbf1b56f2a7.exe
Verdict:
Malicious activity
Analysis date:
2022-05-12 16:40:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ebe72144-2dd3-487c-9580-4c4fc7307f87

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/270145/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Unauthorized injection to a recently created process
Searching for synchronization primitives
Running batch commands
Launching a process
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Creating a file
Creating a process from a recently created file
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
cmd.exe obfuscated packed
Link:
https://www.filescan.io/uploads/627d2bbd40028d3247cd43e1/reports/44825d82-55e4-4267-929a-9816e188195b/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f1f1e657-cf3a-45e8-8b1e-43af57cda280
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/992940
Signature
Antivirus detection for URL or domain
Binary or sample is protected by dotNetProtector
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Tries to detect virtualization through RDTSC time measurements
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 625435 Sample: Nuovo ordine _WJO-002_pdf.exe Startdate: 12/05/2022 Architecture: WINDOWS Score: 100 49 www.szum.company 2->49 51 www.seaverde.com 2->51 71 Found malware configuration 2->71 73 Malicious sample detected (through community Yara rule) 2->73 75 Antivirus detection for URL or domain 2->75 77 9 other signatures 2->77 11 Nuovo ordine _WJO-002_pdf.exe 4 2->11         started        15 windows defender.exe 2 2->15         started        signatures3 process4 file5 47 C:\...47uovo ordine _WJO-002_pdf.exe.log, ASCII 11->47 dropped 81 Injects a PE file into a foreign processes 11->81 17 Nuovo ordine _WJO-002_pdf.exe 11->17         started        20 cmd.exe 3 11->20         started        23 cmd.exe 1 11->23         started        signatures6 process7 file8 53 Modifies the context of a thread in another process (thread injection) 17->53 55 Maps a DLL or memory area into another process 17->55 57 Sample uses process hollowing technique 17->57 59 Queues an APC in another process (thread injection) 17->59 25 explorer.exe 17->25 injected 43 C:\Users\user\...\windows defender.exe, PE32 20->43 dropped 45 C:\...\windows defender.exe:Zone.Identifier, ASCII 20->45 dropped 28 conhost.exe 20->28         started        61 Uses schtasks.exe or at.exe to add and modify task schedules 23->61 30 conhost.exe 23->30         started        32 schtasks.exe 1 23->32         started        signatures9 process10 signatures11 79 Uses netsh to modify the Windows network and firewall settings 25->79 34 netsh.exe 25->34         started        process12 signatures13 63 Self deletion via cmd delete 34->63 65 Modifies the context of a thread in another process (thread injection) 34->65 67 Maps a DLL or memory area into another process 34->67 69 Tries to detect virtualization through RDTSC time measurements 34->69 37 cmd.exe 1 34->37         started        39 explorer.exe 62 34->39         started        process14 process15 41 conhost.exe 37->41         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/bc3eeeaf4c3525845941625539abfe8a1f44190a739552b7f24a6bbf1b56f2a7/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-05-12 13:02:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
118
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xq7o5l2mgusyiwkbmjkttk76ripuigikookvfn7sjjv36g2w6ktq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
37708373f6b4deb76e61c7a9c65200bba9f9d7ca7ebcd82d09242dd9231fa072
Formbook
3bc803f9caaeca99da460ce804bfc9bf4cb8c1dc33d08016002e4fe7263a6111
Formbook
4083d4907b0926bbea1b80c0dd047d1e6c835dc259f9e698c4cfb7f2218b77d3
Formbook
6a3848cae066ae561f1d72908524838d32ad7c95bc18eb155d44211b2fac44fd
Formbook
87bc99f92dd1d5344195aed847c8ed3af8e0aea954133a97fb65834e81278645
Formbook
b7a756c577e078ad9d76c1e7aadb4d0370b1b5ee868f07fad21f33194febe1ec
Formbook
bae9500c6eecd23164e1eba0e489d68938bfff866d47fb9e6c8320b3b8500720
Formbook
+ 15'444 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:vadq loader rat suricata
Link:
https://tria.ge/reports/220512-s7l98aaef5/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Blocklisted process makes network request
Executes dropped EXE
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
ac901749041cfb0297ec26a052604dc949f30cd9e460cc1a40c0c02baf39c322
MD5 hash:
342b052a01c54bae85f2ad0c86286bca
SHA1 hash:
cabc82986ec079cb0ef2d25613bd3b92f104c83f
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/c776069b-e6bb-4e25-b9a5-45598dad6161/
Parent samples :
bc3eeeaf4c3525845941625539abfe8a1f44190a739552b7f24a6bbf1b56f2a7
b0c5c3efda2bcfa189ce5f5b94e1bf298eb712b0ad4e9573293a7883d54f4af9
868924cd1783e9e04d9a137dc3a150d332ffb85315bf29c0fcc9761d635bb432
SH256 hash:
bc3eeeaf4c3525845941625539abfe8a1f44190a739552b7f24a6bbf1b56f2a7
MD5 hash:
934f30b216d669f1fb9a6ddb99bff478
SHA1 hash:
da1fffadb5cfcc43dc66c6eefa3d1dc7e90e4187
Link:
https://www.unpac.me/results/c776069b-e6bb-4e25-b9a5-45598dad6161/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bc3eeeaf4c35/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bc3eeeaf4c3525845941625539abfe8a1f44190a739552b7f24a6bbf1b56f2a7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Babel
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Babel
Rule name:INDICATOR_EXE_Packed_Dotfuscator
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Dotfuscator
Rule name:INDICATOR_EXE_Packed_dotNetProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with dotNetProtector
Rule name:INDICATOR_EXE_Packed_Goliath
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Goliath
Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe bc3eeeaf4c3525845941625539abfe8a1f44190a739552b7f24a6bbf1b56f2a7

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/270145/

Comments