MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0edc415e1c08532783562faf5434e866087e82e257283fc3b0bb0081b040f24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0edc415e1c08532783562faf5434e866087e82e257283fc3b0bb0081b040f24
SHA3-384 hash: b6dc3ea14d0df5d7bcabe01a1f8e25941c907ac7cc59e97d7ae72266dc8ef07a6b918656f3a55245afa7f94ab6f12702
SHA1 hash: 976a5037b21e53bd265a9b82271db389be0279ff
MD5 hash: 31a018d815f0d317b090665f3c4050e8
humanhash: jig-papa-arkansas-romeo
File name:Doc_498575947594986494659499465848658484846584,pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:79'872 bytes
First seen:2021-02-26 06:52:07 UTC
Last seen:2021-02-26 08:54:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 1536:Ky71PKCblLCYkKR1TcIFr33QxB4KU5YGdOr/82fKcejIXWrNoAWfny:KyBPKCblLCdC1TcIFr33QxB4KU5YGdOw
Threatray 17 similar samples on MalwareBazaar
TLSH 8A733190FD57C8DDE85652BD8C5ED81C1162AB5EE0B1461E20DA3B3AA5FF34310A7E0B
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ns4.leaseweb.net
Sending IP: 213.227.149.147
From: Nurul Ain <ain@jpp.com.my >
Subject: Product Inquiry
Attachment: SIN_TONG_HWA_TRADING.IMG (contains "Doc_498575947594986494659499465848658484846584,pdf.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Doc_498575947594986494659499465848658484846584,pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-02-26 06:53:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d07fc608-e793-4f13-87e1-72fd29a604f3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/119340/
Detection(s):
SecuriteInfo.com.Trojan.Heur.DNP.em0@ayoaSpoi.5550.22214.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/619419
Signature
Adds a directory exclusion to Windows Defender
Binary contains a suspicious time stamp
Creates an autostart registry key pointing to binary in C:\Windows
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Svchost Process
Sigma detected: System File Execution Location Anomaly
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 358705 Sample: Doc_49857594759498649465949... Startdate: 26/02/2021 Architecture: WINDOWS Score: 100 71 Multi AV Scanner detection for submitted file 2->71 73 Machine Learning detection for sample 2->73 75 Initial sample is a PE file and has a suspicious name 2->75 77 4 other signatures 2->77 8 Doc_498575947594986494659499465848658484846584,pdf.exe 19 7 2->8         started        13 explorer.exe 2->13         started        15 explorer.exe 2->15         started        17 6 other processes 2->17 process3 dnsIp4 63 coroloboxorozor.com 172.67.172.17, 49729, 49743, 49745 CLOUDFLARENETUS United States 8->63 57 C:\Windows\Resources\Themes\...\svchost.exe, PE32 8->57 dropped 59 C:\Windows\...\svchost.exe:Zone.Identifier, ASCII 8->59 dropped 61 Doc_49857594759498...4846584,pdf.exe.log, ASCII 8->61 dropped 79 Creates an autostart registry key pointing to binary in C:\Windows 8->79 81 Adds a directory exclusion to Windows Defender 8->81 83 Hides threads from debuggers 8->83 85 Drops PE files with benign system names 8->85 19 cmd.exe 1 8->19         started        21 powershell.exe 26 8->21         started        23 powershell.exe 24 8->23         started        25 svchost.exe 13->25         started        87 Drops executables to the windows directory (C:\Windows) and starts them 15->87 29 svchost.exe 15->29         started        file5 signatures6 process7 dnsIp8 31 conhost.exe 19->31         started        33 timeout.exe 19->33         started        35 conhost.exe 21->35         started        37 conhost.exe 23->37         started        65 coroloboxorozor.com 25->65 67 192.168.2.1 unknown unknown 25->67 89 Multi AV Scanner detection for dropped file 25->89 91 Machine Learning detection for dropped file 25->91 93 Adds a directory exclusion to Windows Defender 25->93 39 cmd.exe 25->39         started        41 powershell.exe 25->41         started        43 powershell.exe 25->43         started        69 coroloboxorozor.com 29->69 95 System process connects to network (likely due to code injection or exploit) 29->95 97 Hides threads from debuggers 29->97 45 powershell.exe 29->45         started        signatures9 process10 process11 47 conhost.exe 39->47         started        49 timeout.exe 39->49         started        51 conhost.exe 41->51         started        53 conhost.exe 43->53         started        55 conhost.exe 45->55         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c0edc415e1c08532783562faf5434e866087e82e257283fc3b0bb0081b040f24/
Threat name:
ByteCode-MSIL.Downloader.BaseLoader
Create hunting rule
Status:
Malicious
First seen:
2021-02-26 06:52:18 UTC
AV detection:
21 of 49 (42.86%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ydw4ifpbyccte6bvml5pkq2oqzqip2boevzih7b3boyaqgyeb4sa._file
Verdict:
unknown
Similar samples:
6c7624c020bb11d5803286dc0fc1d9ee44d21be97207573051bcd322091a731b
Formbook
6e522cba657cf758c4443cdb216d7755a1ebf509b36b6a0e78ec183ac6aa7b72
Formbook
80d3f66ba9b603c7f90d3303718763b736e8cfa76f676ff4a57db67b96610dc6
Formbook
98bba6280dc438b35e3d0a4f468d1e50dd44bdafdd3e8c396a6dacf6be50fd71
Formbook
b903be7c680d5eb78f951c7e1743b53e0cdfae05e19fa6fe7e77c84c29df1156
Formbook
bcfcc5a278671fbe1b5f5f27c6d61921add83e57a0c61f80a165455b3fe0875a
Formbook
c15fd959d72ff5dd978a6e8e15877b3f41fba6a89d9bb4890287668b17d05a3c
Formbook
e6628a7533fc340c5a6c659ecaba8a7626bc853c96d6e3571427aaaf124edde1
Formbook
f4dcdf575d7c25bdba3e73ac2ff890b1103dcf43325b8876c5215204fcf7d1fb
Formbook
fccc2c9b4b7755630827b24eb96f2dd1f989e43c86a8f218e6709a98160112f1
Formbook
+ 7 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence trojan
Link:
https://tria.ge/reports/210226-wdcq45etr6/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Checks whether UAC is enabled
Windows security modification
UAC bypass
Windows security bypass
Unpacked files
SH256 hash:
c0edc415e1c08532783562faf5434e866087e82e257283fc3b0bb0081b040f24
MD5 hash:
31a018d815f0d317b090665f3c4050e8
SHA1 hash:
976a5037b21e53bd265a9b82271db389be0279ff
Link:
https://www.unpac.me/results/5b141630-1dfc-4100-821c-77f6ae4cfe63/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 2c4a614f2ec55fa434983da9758e39b22771eda76e724ea31a91efc6184fb3eb

Formbook

Executable exe c0edc415e1c08532783562faf5434e866087e82e257283fc3b0bb0081b040f24

(this sample)

  
Dropped by
MD5 110f6ccb4b895841544a8aee876a4183
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/119340/
  
Dropped by
SHA256 2c4a614f2ec55fa434983da9758e39b22771eda76e724ea31a91efc6184fb3eb

Comments