MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bef721bdc066308d9966d0ff47fa2458141c6da5c0de46d14f8b56154dddbb4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 12

Intelligence 12 IOCs YARA 15 File information Comments

SHA256 hash:	bef721bdc066308d9966d0ff47fa2458141c6da5c0de46d14f8b56154dddbb4a
SHA3-384 hash:	c8c04f7b4e61c6be0b6c79bf2a38aa2bde6a60b0a90978494558ef6b7cfdcc56e823ad6a5ae67b76103fceff849562b6
SHA1 hash:	bdb342f4d7776545f9ca05e12ae67cf0a8b144b3
MD5 hash:	e5e895c6606982714dcef8910ac4396e
humanhash:	solar-bakerloo-floor-undress
File name:	delivery invoice.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'725'536 bytes
First seen:	2024-09-17 18:56:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	22a65106d3d84ea74d966fa0424a5a0c (8 x Formbook, 2 x AsyncRAT, 1 x AgentTesla)
ssdeep	49152:uAodtaG9kS2U84B+FLan9k5TRM9zlEVjuhfPNRp:S/B1RlPNH
Threatray	51 similar samples on MalwareBazaar
TLSH	T1BA85CF19E3A911FCD52BC634CA559233E6B170560B21A4CF1B99C7452FB3EE26B7B302
TrID	47.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 35.2% (.EXE) InstallShield setup (43053/19/16) 8.6% (.EXE) Win64 Executable (generic) (10523/12/4) 4.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Anonymous
Tags:	exe FormBook signed

Code Signing Certificate

Organisation:	Microsoft Code Signing PCA 2011
Issuer:	Microsoft Code Signing PCA 2011
Algorithm:	sha256WithRSAEncryption
Valid from:	2024-09-16T15:12:17Z
Valid to:	2025-09-16T15:12:17Z
Serial number:	cf4203a2df24f6072a1c39857b0e08bb
Thumbprint Algorithm:	SHA256
Thumbprint:	e0825de76a97cab21ddbf92a8f3fa97af0e6cfeb94c39d3826a7f9aea0c9ad9f
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

585

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

delivery invoice.exe

Verdict:

Suspicious activity

Analysis date:

2024-09-17 18:56:52 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/6d036c24-f7bb-4613-8bb8-9388d1d86fef

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win64.Evo-gen.7972.30612.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66e9d0ff5d6a2b58599a9d66

Tags:

Encryption Execution Generic Network Static Stealth

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

fingerprint hacktool lolbin masquerade microsoft_visual_cc overlay packed regedit shell32

Link:

https://www.filescan.io/uploads/66e9d1093c9389b729b9105b/reports/5beae8f2-ac04-487c-89b3-827f69d6a2e6/overview

Verdict:

Malicious

Labled as:

Kryptik.HXWO trojan

Link:

https://www.hybrid-analysis.com/sample/bef721bdc066308d9966d0ff47fa2458141c6da5c0de46d14f8b56154dddbb4a

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a2b709b2-4511-4bbc-8c32-2dbd1ca5e5d6

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1512776

Signature

Adds a directory exclusion to Windows Defender

AI detected suspicious sample

Allocates memory in foreign processes

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Writes to foreign memory regions

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/bef721bdc066308d9966d0ff47fa2458141c6da5c0de46d14f8b56154dddbb4a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bef721bdc066308d9966d0ff47fa2458141c6da5c0de46d14f8b56154dddbb4a/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x33sdpoamyyi3glg2d7up6relakby3nfydpenukprnlbkto5xnfa._file

Verdict:

malicious

Label(s):

formbook

Formbook

3ca79e899fc4afb051d79323ae71ec356bd8a8cff6cebbfba6c8ce80f41db2a3

Formbook

442e64297fefa272744b3e6ed8cc9eb460e182d58bc256964fa73e6c3694a926

Formbook

619785d76ee2055a1aca904e2a3e7fb2db9682b99602f7537ab8cd8ade9551da

Formbook

8d278608d1d1c4c5b6c048020c23351e75203066af1ae1e63c5c5ac0170cd3de

Formbook

e3982b1cbd3445eb68e177c578113fb2d35b4ed924fbdd7486841846c7a5beb5

Formbook

+ 41 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

execution

Link:

https://tria.ge/reports/240917-xlxahsyhlc/

Behaviour

Kills process with taskkill

Runs regedit.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in System32 directory

Suspicious use of SetThreadContext

Checks computer location settings

Uses the VBS compiler for execution

Command and Scripting Interpreter: PowerShell

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/a7d0b9ab-f1fa-45fe-801e-5ce938082e73

Unpacked files

SH256 hash:

bef721bdc066308d9966d0ff47fa2458141c6da5c0de46d14f8b56154dddbb4a

MD5 hash:

e5e895c6606982714dcef8910ac4396e

SHA1 hash:

bdb342f4d7776545f9ca05e12ae67cf0a8b144b3

Link:

https://www.unpac.me/results/6a4bfbff-0708-4e1d-8d77-f89d89b6b4fd/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bef721bdc066/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bef721bdc066308d9966d0ff47fa2458141c6da5c0de46d14f8b56154dddbb4a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	Detect_APT29_WINELOADER_Backdoor Create hunting rule
Author:	daniyyell
Description:	Detects APT29's WINELOADER backdoor variant used in phishing campaigns, this rule also detect bad pdf,shtml,htm and vbs or maybe more depends
Reference:	https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	Jupyter_infostealer Create hunting rule
Author:	CD_R0M_
Description:	Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Reviews

ID	Capabilities	Evidence
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AdjustTokenPrivileges
WIN32_PROCESS_API	Can Create Process and Threads	ADVAPI32.dll::OpenProcessToken KERNEL32.dll::OpenProcess KERNEL32.dll::VirtualAllocExNuma KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThreadpoolIo KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetSystemInfo
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::AllocConsole KERNEL32.dll::FreeConsole KERNEL32.dll::GetConsoleWindow KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::LookupPrivilegeValueW
WIN_BCRYPT_API	Can Encrypt Files	bcrypt.dll::BCryptDestroyKey bcrypt.dll::BCryptGenerateSymmetricKey bcrypt.dll::BCryptGenRandom bcrypt.dll::BCryptOpenAlgorithmProvider bcrypt.dll::BCryptCloseAlgorithmProvider
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample