MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfd180717755dd026fcbc5b370cea34a1ed365deb5e512420b63a5382f111764. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bfd180717755dd026fcbc5b370cea34a1ed365deb5e512420b63a5382f111764
SHA3-384 hash: cf38a1b05f8c8c91218b98503168a20da743170d7ff3386fe268e11caabf9bfbafd5a7e4b35801b2a1238ea4c86552e2
SHA1 hash: 28513b7108e382d811902d22d3749568adf296eb
MD5 hash: 90c8ef1083fbf63ae33f23d51513a611
humanhash: illinois-maryland-lamp-red
File name:INVOICES.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:700'416 bytes
First seen:2024-10-29 15:51:23 UTC
Last seen:2024-10-29 17:24:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fc6683d30d9f25244a50fd5357825e79 (92 x Formbook, 52 x AgentTesla, 23 x SnakeKeylogger)
ssdeep 12288:DozGdX0M4ornOmZIzfMwHHQmRROXKsV2eyIXfsCaMm4iQpvJ35LqfIPSSXg:D4GHnhIzOa/ePECCihpLqAP6
Threatray 3 similar samples on MalwareBazaar
TLSH T10FE423D5E0D1A19ED4A205F94C128D3B356FFD2DE5206C4BB2A77A08ED376428623C6E
TrID 35.7% (.EXE) UPX compressed Win32 Executable (27066/9/6)
35.0% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
8.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon 0087a529a9ad63b1 (2 x Formbook, 1 x RedLineStealer)
Reporter Racco42
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
448
Origin country :
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
INVOICES.exe
Verdict:
No threats detected
Analysis date:
2024-10-29 17:10:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/740b8467-f342-4a65-a94b-78b1aaa15315

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.FileRepMalware.468.15802.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67210570a75e41aa6722c48e
Tags:
Nymeria Autoit Emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit compiled-script lolbin masquerade microsoft_visual_cc packed packed packed packer_detected shell32 upx
Link:
https://www.filescan.io/uploads/672104a7756c933fb11d700f/reports/4e3c00a4-f07c-465b-b456-31a0fac4e65e/overview
Verdict:
Malicious
Labled as:
AIT:Trojan.Nymeria.6429;AIT:Trojan.Nymeria
Link:
https://www.hybrid-analysis.com/sample/bfd180717755dd026fcbc5b370cea34a1ed365deb5e512420b63a5382f111764
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/24980b7d-625d-4002-a602-35ae614b9863
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1544728
Signature
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1544728 Sample: INVOICES.exe Startdate: 29/10/2024 Architecture: WINDOWS Score: 100 28 www.68529.xyz 2->28 30 www.treatyourownhip.online 2->30 32 18 other IPs or domains 2->32 42 Multi AV Scanner detection for submitted file 2->42 44 Yara detected FormBook 2->44 46 Binary is likely a compiled AutoIt script file 2->46 50 3 other signatures 2->50 10 INVOICES.exe 2 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 28->48 process4 signatures5 62 Binary is likely a compiled AutoIt script file 10->62 64 Writes to foreign memory regions 10->64 66 Maps a DLL or memory area into another process 10->66 68 Switches to a custom stack to bypass stack traces 10->68 13 svchost.exe 10->13         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 16 XORjEgwNIUb.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 AtBroker.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 XORjEgwNIUb.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.68529.xyz 107.163.130.253, 49745, 49746, 49747 TAKE2US United States 22->34 36 www.plyvik.info 67.223.117.142, 49741, 49742, 49743 VIMRO-AS15189US United States 22->36 38 11 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/bfd180717755dd026fcbc5b370cea34a1ed365deb5e512420b63a5382f111764
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bfd180717755dd026fcbc5b370cea34a1ed365deb5e512420b63a5382f111764/
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2024-10-29 00:52:47 UTC
File Type:
PE (Exe)
Extracted files:
23
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x7iya4lxkxoqe36lywzxbtvdjipngzo6wxsreqqlmostqlyrc5sa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
unknown_loader_036
Create hunting rule
Similar samples:
bc02d5b7227b4b090be1d83c432a9227fdff9c9450bcd03a7eed8ab3b9486441
Formbook
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery upx
Link:
https://tria.ge/reports/241029-ta2t3swgja/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Verdict:
Malicious
Tags:
trojan formbook
YARA:
SUSP_Imphash_Mar23_3
Link:
https://app.threat.zone/submission/49cc1596-060e-4990-ac42-af6f6d53b86c
Unpacked files
SH256 hash:
785d8a4a38a9e2b5b711a256de85f34bc24961d5d7bc4394a81e17eaf7d0ac1e
MD5 hash:
6f9910135936e55b442f934804665037
SHA1 hash:
0ea33b5f3c9ca50f65471958279693a4e8bb9d9f
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/e7a0c068-7ea8-4a40-8c14-9d5e2743d29d/
Parent samples :
bc02d5b7227b4b090be1d83c432a9227fdff9c9450bcd03a7eed8ab3b9486441
bfd180717755dd026fcbc5b370cea34a1ed365deb5e512420b63a5382f111764
09b4294185e7c2cf4ef94bf7b2a47ec7ce7187e0dcca67498443019ef53bcd02
e89e9b01f3aa1555df59c9d5979d6a1a26fbd7c89de2cd8888956f8866b96cea
SH256 hash:
304b029210283e1d22d8cbddc73e918843f08f40ecdc74ceff40f31dfc6dbcc5
MD5 hash:
8bf9b73fd828c57a0f67c6b71903d0b3
SHA1 hash:
a0461be764b7c39e6ea6bc712ca2d713617a8cf9
Link:
https://www.unpac.me/results/e7a0c068-7ea8-4a40-8c14-9d5e2743d29d/
SH256 hash:
4b6133e5f9da698edc3a25cc17ee43a30473e07ac6b2e103aff8f498dbea49e8
MD5 hash:
02475fef8dfb2a535f15e64b73d5ce02
SHA1 hash:
bde939bc263c6d09090f5c08d006db4353550bd2
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/e7a0c068-7ea8-4a40-8c14-9d5e2743d29d/
SH256 hash:
bfd180717755dd026fcbc5b370cea34a1ed365deb5e512420b63a5382f111764
MD5 hash:
90c8ef1083fbf63ae33f23d51513a611
SHA1 hash:
28513b7108e382d811902d22d3749568adf296eb
Link:
https://www.unpac.me/results/e7a0c068-7ea8-4a40-8c14-9d5e2743d29d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bfd180717755/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bfd180717755dd026fcbc5b370cea34a1ed365deb5e512420b63a5382f111764

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_Imphash_Mar23_3
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:Internal Research
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe bfd180717755dd026fcbc5b370cea34a1ed365deb5e512420b63a5382f111764

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetAce
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetUseConnectionW

Comments