MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3a8be782a08e1ff2a2f10ea6b6d604d1056d95a9e9e9428ff94db3bdfa6bd84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3a8be782a08e1ff2a2f10ea6b6d604d1056d95a9e9e9428ff94db3bdfa6bd84
SHA3-384 hash: 5d89deddd7dd4c7b950b41ff8e4f777888e1153c4a760dfd2ff2395297cc5926865def7278a8dfadba691867675ddb5e
SHA1 hash: 81e00cde34ca8d5edafec1e37d43cf2817ef3918
MD5 hash: 55209bf84c450dd1a548fa8e05df7b8a
humanhash: monkey-steak-lima-snake
File name:Payment Advise 4_10_23 pdf.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:297'584 bytes
First seen:2023-10-04 05:56:34 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:FPXD/pyyXeYzf2vuaaEcgF4wl3uFKZY/ywr6ZlKRA3BvMiS:hDLXJav9aEiwle1hUltxve
TLSH T17054235692C3326F0B4CDF8EC8CF53286D8E9CA251D7667CB6D8CDDA4692DA4B0453E0
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook payment rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Accounts Payable<knutkh@vissim.no>" (likely spoofed)
Received: "from [81.161.229.115] (unknown [81.161.229.115]) "
Date: "4 Oct 2023 04:46:01 +0200"
Subject: "Payment advise 4-10-2023"
Attachment: "Payment Advise 4_10_23 pdf.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Payment Advise 4_10_23 pdf.exe
File size:313'038 bytes
SHA256 hash: 795998e9064cb981d6a40a34fbeee48381121ea7ac7175ffe5b506b11cf843d7
MD5 hash: ef6f57941b0592e95cbea40f914cac18
MIME type:application/x-dosexec
Signature Formbook
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27342.RarHeur.v5.HideExt.UNOFFICIAL
Create hunting rule

Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/c3a8be782a08e1ff2a2f10ea6b6d604d1056d95a9e9e9428ff94db3bdfa6bd84/results/dashboard
Verdict:
Likely Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control lolbin masquerade overlay packed remcos shell32 threat virus
Link:
https://www.filescan.io/uploads/651cfeb064965c51f7739c19/reports/39feffd8-bc50-416e-822c-1ad8050e173d/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/c3a8be782a08e1ff2a2f10ea6b6d604d1056d95a9e9e9428ff94db3bdfa6bd84
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3a8be782a08e1ff2a2f10ea6b6d604d1056d95a9e9e9428ff94db3bdfa6bd84/
Threat name:
Win32.Ransomware.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-10-04 02:40:42 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
18 of 36 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=youl46bkbdq76krpcdvgw3lajuifnwk2t2pjikh7stntxx5gxwca._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:sn26 rat spyware stealer trojan
Link:
https://tria.ge/reports/231004-gs7f3ahe21/
Behaviour
Gathers network information
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
Formbook payload
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c3a8be782a08e1ff2a2f10ea6b6d604d1056d95a9e9e9428ff94db3bdfa6bd84

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar c3a8be782a08e1ff2a2f10ea6b6d604d1056d95a9e9e9428ff94db3bdfa6bd84

(this sample)

Formbook

Executable exe 795998e9064cb981d6a40a34fbeee48381121ea7ac7175ffe5b506b11cf843d7

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 795998e9064cb981d6a40a34fbeee48381121ea7ac7175ffe5b506b11cf843d7
  
Dropping
Formbook
  
Dropping
MD5 ef6f57941b0592e95cbea40f914cac18

Comments