MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bf7d050627a7bf67ad74bed6cf159d30c88423a1c0ef53f9fdc80b6977e79d9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 11
| SHA256 hash: | bf7d050627a7bf67ad74bed6cf159d30c88423a1c0ef53f9fdc80b6977e79d9e |
|---|---|
| SHA3-384 hash: | 3dda16fbf7073e89f8dbbcd8cfde84161efc7cdc0b312b9cd6acd2c386d4f503a14719a76e70db23dcf2cee9d099bceb |
| SHA1 hash: | 6704b7e7022b31053dc6389f946db8505b5681e6 |
| MD5 hash: | 5e3e9036788808920a3ca6c8943ed407 |
| humanhash: | network-single-football-shade |
| File name: | r5月帐目和发票.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 656'384 bytes |
| First seen: | 2023-05-11 10:32:03 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 6144:TYvasUQMHx8s+rck5kOGNMx4Dv1xMc1sH+p0GpyGsa8Tp4VolYYWWjp12wl5Obps:TqUQmJ+S9NMxyvta9GsaLiYr0vz4pud |
| Threatray | 2'811 similar samples on MalwareBazaar |
| TLSH | T10FD4DF48523BBFE1CAA817F0261434434B7DA11A74B8E0BCBD5B74C9C8AEB115BD4B67 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | 3571413931695171 (5 x Formbook) |
| Reporter |  FXOLabs |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
265
Origin country :
BRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
r5月帐目和发票.exe
Verdict:
No threats detected
Analysis date:
2023-05-11 10:32:44 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Status:
Malicious
First seen:
2023-05-11 07:08:45 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
18 of 24 (75.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'801 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
5bf082285db878674889c745705747b6baa2e2780b9c6562877aaf62d3faf99f
MD5 hash:
e5dfd73907860d46379d7b5080a11d38
SHA1 hash:
f70fe8895457dd33762677dd488a1bae43cbbb4c
SH256 hash:
ef7e491d05f2be746f1d82c124eef013037f32a23ec918a12b48bd5e1085906b
MD5 hash:
4632ce7d13d6d8ef78e8a56e101d872f
SHA1 hash:
85010cb551b2212496cd0f7f3df8418454237afc
SH256 hash:
30991c7c1844c8dce06164a72c2d0d91bea6074a9a28c3fd57cab18a7ccc2d7c
MD5 hash:
8eae3230cff8c9ca23c41bb18e5215d2
SHA1 hash:
c9fc102e3e2315bc0346a83d151634298ba8f1ed
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
SH256 hash:
c72ca892abebd8794a9544913d071c3c91356f5075509717727e180e87cb98ba
MD5 hash:
25383385b11436b817ed4dc0419f4e24
SHA1 hash:
9441f35f45a30503ebb2c717209f29341b5b48b6
SH256 hash:
bf7d050627a7bf67ad74bed6cf159d30c88423a1c0ef53f9fdc80b6977e79d9e
MD5 hash:
5e3e9036788808920a3ca6c8943ed407
SHA1 hash:
6704b7e7022b31053dc6389f946db8505b5681e6
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.