MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c5444c85b810f99e008f31b9ea1b1a128df74044cacf326c27fe1937f5b45fdb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | c5444c85b810f99e008f31b9ea1b1a128df74044cacf326c27fe1937f5b45fdb |
|---|---|
| SHA3-384 hash: | 2d20e58e126680c73c2303221fa657774168d80b6320aca3b8b5e9af5873b64ee7859f94223ee49e14e22c668ccbe6f7 |
| SHA1 hash: | c1516308209905c154e08045694681c1717d736c |
| MD5 hash: | f9fd38f9ee9d4cdb870343b9c06495ab |
| humanhash: | may-zebra-charlie-delta |
| File name: | HSBC Payment Adice_pdf.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 622'080 bytes |
| First seen: | 2023-11-22 07:15:53 UTC |
| Last seen: | 2023-11-22 07:16:23 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 12288:h8oyB6vv3UxVPe5SWz1czGoIqUyceHMDwNg+tOakFUnBTS4GUd8ORRK:aXqvmVPelcqNh1DwWs1dBerUOORR |
| Threatray | 252 similar samples on MalwareBazaar |
| TLSH | T181D423133D59ABA3E63B8BF58064018847F7A93F56E5E59A8EC231EB54D9B044A30F13 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  lowmal3 |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
333
Origin country :
DEVendor Threat Intelligence
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
masquerade packed
Verdict:
Malicious
Labled as:
Malware
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus detection for URL or domain
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-11-22 07:16:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
18 of 23 (78.26%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 242 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Unpacked files
SH256 hash:
c04ddd6c59e5a7a09b14d6e7a63f631ebe8aaa95e082b02c549f156c55562ce9
MD5 hash:
57eeb622b1f517875f53865fa5b44d2b
SHA1 hash:
18638e3a645255de7a40b1a73e906b153e174bc8
Detections:
win_formbook_w0
win_formbook_g0
SH256 hash:
e08d0968bdf8a42150184fde0ac64cf29c60cd57ec968eec358c34698f4c4a3a
MD5 hash:
ffaac75fbfb4ba8cf9fc3cb7e9399344
SHA1 hash:
413ba56d78a56f06f466491c211068b46489ae0b
SH256 hash:
d01f3dea3851602ba5a0586c60430d286adf6fcc7e17aab080601a66630606e5
MD5 hash:
579197d4f760148a9482d1ebde113259
SHA1 hash:
cf6924eb360c7e5a117323bebcb6ee02d2aec86d
SH256 hash:
186bc47f84bd549cd52598955cdb159efc8f11c6c04ab3d72b42f2e85aeb7669
MD5 hash:
46f31ce406879d3fa817588414d40997
SHA1 hash:
86724872ac35ec0a7f2ba704c9ccb5b6120384f5
SH256 hash:
8eb225ef60d9647154b41311ed1a6b11487cdd95eea25a78cc2956091137d86c
MD5 hash:
b08c987aab4de7b7e7d51eb21771098f
SHA1 hash:
23ff7db09a13061c9004cf32741851d040a25704
SH256 hash:
d6549ca2e37bf05bee37f656020ad136a05a06e8a57cfe45f306d7c88ccbe697
MD5 hash:
25ac409e0efcb3b669e6f83750b9dd0c
SHA1 hash:
d8859d0bca9f00b21c4615e10583b583719a7b3e
SH256 hash:
bb079dd0cd9fb85532479994b4af16a440edf71edb5ad61cb861be9685a3a434
MD5 hash:
39790d8f309e6910e21a815cdedefd68
SHA1 hash:
b9482a031e2d73f0640dcc0a0798ad10479adbf0
SH256 hash:
edc2047b49602a2061b1a56289f3c34f54745b1dc2aebdee1a1b620f9d9d8735
MD5 hash:
ccb7888ee25f34c644ed0eb847f3bff4
SHA1 hash:
aaf7c8f8a51a3ff6374bb97d15a7f086050439dc
SH256 hash:
704efd646050a9c5050ab9ea1a80c54442891a9d93e9ef7bdba697fd6688711c
MD5 hash:
8e5c78baf768f598c70ccaf0c765f0e2
SHA1 hash:
91b4d0eaf5b5cd4365078bc8d2b90bb10673d97b
SH256 hash:
7dbb3b044673571ca5a58b0e1cc3da6187b24b13713b11f5f8def83fe0aaa3e8
MD5 hash:
d5633ad2a6826837a415c9ab4c7aeee7
SHA1 hash:
6a5b4018bc5539275c57492ab75030ce8881e60e
SH256 hash:
f9586a725bb3329ebcd1e8b76bafe3d1cf45350070dcf433aa6ab554ee9578f9
MD5 hash:
dfee8c82f61b8eb09a09f39418b405aa
SHA1 hash:
3bfb65ec46aa4d13c1ce8aa07cc73a4455b25b6f
SH256 hash:
c5444c85b810f99e008f31b9ea1b1a128df74044cacf326c27fe1937f5b45fdb
MD5 hash:
f9fd38f9ee9d4cdb870343b9c06495ab
SHA1 hash:
c1516308209905c154e08045694681c1717d736c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AgentTesla_DIFF_Common_Strings_01 |
|---|---|
| Author: | schmidtsz |
| Description: | Identify partial Agent Tesla strings |
| Rule name: | BitcoinAddress |
|---|---|
| Author: | Didier Stevens (@DidierStevens) |
| Description: | Contains a valid Bitcoin address |
| Rule name: | DebuggerCheck__GlobalFlags |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Active |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Thread |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | Formbook |
|---|---|
| Author: | kevoreilly |
| Description: | Formbook Payload |
| Rule name: | maldoc_find_kernel32_base_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | maldoc_getEIP_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Windows_Trojan_Formbook |
|---|---|
| Author: | @malgamy12 |
| Rule name: | Windows_Trojan_Formbook_1112e116 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_formbook_w0 |
|---|---|
| Author: | @malgamy12 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.