MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd90dba924ee14fc81a245124d6e9b425b290f83cd793f76573b1408ebf5f284. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 19

Intelligence 19 IOCs YARA 16 File information Comments

SHA256 hash:	bd90dba924ee14fc81a245124d6e9b425b290f83cd793f76573b1408ebf5f284
SHA3-384 hash:	7b054ef542a77d0253ca29809e4e2c9992aad0a614ba422c15b903d5087fc666aad89f81eefabe46cde035301dc05e85
SHA1 hash:	136f3ed7b097d9af4046c7119c0f8856c67df474
MD5 hash:	316d52ffa3e819ca0afe9c8c70e93eee
humanhash:	louisiana-missouri-alaska-blue
File name:	rDocumentodesolicitacaodepedidoNo24850.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	679'936 bytes
First seen:	2024-05-20 19:37:47 UTC
Last seen:	2024-05-20 20:30:58 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:nJEasCzbd0aBJHAKoumkG7yC9AhPhakJzJGMjta9c3kOdJhC+mugBY:7sVCgQA9LyJGMJT0c09
TLSH	T1CBE4234AB7F82D17D3BE037610B5040C93F9A921E5A6F79B4F9104CE1C67788AA52F83
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	FXOLabs
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

336

Origin country :

Vendor Threat Intelligence

Malware family:

formbook

ID:

File name:

Documento de solicitação de pedido N° 24850.001

Verdict:

Malicious activity

Analysis date:

2024-05-20 15:45:00 UTC

Tags:

formbook xloader

Link:

https://app.any.run/tasks/a0f1f2dc-d128-4d8d-9183-651ee2a8b44a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.DownLoader46.64233.3911.20029.UNOFFICIAL

Verdict:

Malicious

Score:

95.7%

Tags:

Banker Encryption Execution Swotter Dexter

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a process with a hidden window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Adding an exclusion to Microsoft Defender

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/bd90dba924ee14fc81a245124d6e9b425b290f83cd793f76573b1408ebf5f284

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8d5b3301-7258-4036-896e-4f8cc5ca62a0

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1444548

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect virtualization through RDTSC time measurements

Yara detected AntiVM3

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/bd90dba924ee14fc81a245124d6e9b425b290f83cd793f76573b1408ebf5f284

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/bd90dba924ee14fc81a245124d6e9b425b290f83cd793f76573b1408ebf5f284/

Threat name:

Win32.Infostealer.Limitail

Status:

Malicious

First seen:

2024-05-20 13:03:03 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xwinxkje5ykpzanciuje23u3ijnssd4dzv4t65sxhmkar27v6kca._file

Verdict:

malicious

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:pz12 execution rat spyware stealer trojan

Link:

https://tria.ge/reports/240520-ycc1yseb72/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Formbook payload

Formbook

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/efd12e50-8795-42c6-adf8-bf3b93f77fb0

Unpacked files

SH256 hash:

0b20fb89c6efad8f81691293666d012b1401a92cf1826cc221552bb13158693f

MD5 hash:

96e228ff2b554adf664f368c8b3b2bc6

SHA1 hash:

5b03d91eb65047fb99296e96b08e252622037596

Detections:

FormBook

win_formbook_w0

win_formbook_auto

win_formbook_g0

Formbook

Link:

https://www.unpac.me/results/00feeea6-53ca-4150-a44b-5caf647e8200/

Parent samples :

a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de
bd90dba924ee14fc81a245124d6e9b425b290f83cd793f76573b1408ebf5f284
c91c2f084fcad441661842ee87995440960cda62391d260e5ff572f400d883af
771345cacf6009f18aee571afcba07b7d20f61e411c23f15a1d2b87803c68bee
e10280c91dc1fb46756d9473163eec9052b8c8a352955d0f21a24246da054ba2
f5368436685277dd73f2ad2fe3be473fd4ab4f5c6691c1075eda750e8bfbcdb9
3dd9da5f91ea1de269504d905252059371eafacb8b71b3bc0ac2c38a16db709a
078b3704bde85e8ad84e4c21ca910f5d5367843bbecc2a384acc3fd89cd3553c
98561472f0008145e959e31a6dc3f196f1fc6f05a938ab9fc8900c15821e0a1e
7d39dde72383a557950523dfc9e5a64718323fcebf5d41aba286763c9ae7b39e
943d44f043396e794716c4d82c4345e749eead0807592339cdde186a7bd83c51
f8353eb981e7fce8af5663a30b6ad844d44d7eda87ff717f85f0046e3c065985
40cebb630f935210e93b1e5569a1181a0c19cee3c4c129550dece7add29f27b6
9a10e3d9debfb494bf65772bcef8c60066bdd7993ab10d3db91f2d7003ba779d

SH256 hash:

f540e8d603962027b3a1f8b86d035281bfbdd3a05a621ead255825bc2082632a

MD5 hash:

d172f59251b97b415b621d302e1be2b7

SHA1 hash:

b1534e603749c901b5ac185f20e281f6be7fa908

Link:

https://www.unpac.me/results/00feeea6-53ca-4150-a44b-5caf647e8200/

SH256 hash:

2976b734d23c2f015cf0e860a50dc91a887c66af69f3ebefab57b67de773af65

MD5 hash:

3fff75242a0d59ead170581bf1775ca0

SHA1 hash:

701b4f600c11635195c1d64c0c6335f51de72d00

Link:

https://www.unpac.me/results/00feeea6-53ca-4150-a44b-5caf647e8200/

SH256 hash:

27ddc96465ac70b602e730ca4b28018a2875f5aca4215f3d8608b9defc8bf23d

MD5 hash:

1b2614489be216f14010dea5dee50dc5

SHA1 hash:

046c2462662dc3adea1c79121b4d865665850e23

Link:

https://www.unpac.me/results/00feeea6-53ca-4150-a44b-5caf647e8200/

SH256 hash:

bd90dba924ee14fc81a245124d6e9b425b290f83cd793f76573b1408ebf5f284

MD5 hash:

316d52ffa3e819ca0afe9c8c70e93eee

SHA1 hash:

136f3ed7b097d9af4046c7119c0f8856c67df474

Link:

https://www.unpac.me/results/00feeea6-53ca-4150-a44b-5caf647e8200/

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bd90dba924ee/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bd90dba924ee14fc81a245124d6e9b425b290f83cd793f76573b1408ebf5f284

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

exe bd90dba924ee14fc81a245124d6e9b425b290f83cd793f76573b1408ebf5f284

(this sample)

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample