MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c0ab699ce37ff46eeb49f0a5d9dd1ca392580d959dd6ad8fda06418fb0c39c6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | c0ab699ce37ff46eeb49f0a5d9dd1ca392580d959dd6ad8fda06418fb0c39c6f |
|---|---|
| SHA3-384 hash: | 7c97c3aea8882ac8049b8eb922aeef23940664c67f30c5db4f237973b145264bcf20599a9665604896ac8d02cdf428a7 |
| SHA1 hash: | a28f9fc61ab1d1e20e6b16e16bc75d6fe6fcbb23 |
| MD5 hash: | d194a712e3470dbc9d0d31123394a222 |
| humanhash: | neptune-four-eight-montana |
| File name: | Quotation EQ 62725-NA001-0223.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 691'200 bytes |
| First seen: | 2024-09-09 11:30:53 UTC |
| Last seen: | 2024-09-19 12:29:20 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'743 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 12288:LP17QDhP/bdd2qcIHTA3nMavDPatPmK51BkfyrQZCgBFUBM4+9i72l:OjdTHE3nNvDPUPZnaRBFkMjkE |
| Threatray | 34 similar samples on MalwareBazaar |
| TLSH | T178E412B97B25F995C99807380671E3362A392E4DF116E30B8FFDACFB74062C5AC04656 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| File icon (PE): |  |
| dhash icon | 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer) |
| Reporter |  adrian__luca |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
3
# of downloads :
392
Origin country :
HUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Quotation EQ 62725-NA001-0223.exe
Verdict:
No threats detected
Analysis date:
2024-09-09 11:43:59 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
97.4%
Tags:
Execution Stealth Msil
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Adding an exclusion to Microsoft Defender
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Malware
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.Jalapeno
Status:
Malicious
First seen:
2024-09-09 03:56:29 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
16 of 24 (66.67%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 24 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
discovery execution
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
d2dd73cc37b0f3d51c1fb285ccef50ab8fb02546300f2152731931be2d002062
MD5 hash:
370070dbda87ab67c51e5a2af782bd43
SHA1 hash:
f59a1d1fe58693963d3e74c01a308c4a6b9d913b
SH256 hash:
e176048fa7eb32d13b2b2e20e6a33d3041d55705e01e080b7dab70d92aecc595
MD5 hash:
9f71c956777b33921d66996993e037df
SHA1 hash:
5aa2fb2dbb8ce671b23f81b4018296728fc0ec49
SH256 hash:
cf4e6f1a613c5a811b3ce54e1cdaef5baa51b637dd12ef1540a410015d71e333
MD5 hash:
cfe658dec79a3f1eb0f77990c75bba8d
SHA1 hash:
80eea8196f0c60f828bc6af7603d584a7e0e30fb
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
c59a72e874640d2d2c5669edc14fdeb82a72cbacde61679907d2926b8ed79d08
MD5 hash:
b37fc99b846edbde0d0f36bee1760849
SHA1 hash:
0016396b048dcbda5b87742c32678f706db6362c
SH256 hash:
c0ab699ce37ff46eeb49f0a5d9dd1ca392580d959dd6ad8fda06418fb0c39c6f
MD5 hash:
d194a712e3470dbc9d0d31123394a222
SHA1 hash:
a28f9fc61ab1d1e20e6b16e16bc75d6fe6fcbb23
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.