MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c98dbdfcc2c587c18cdaf96dfe08b6e263209aee9cc314d6b2d0e42ffcb1a0ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 9

Intelligence 9 IOCs YARA 11 File information Comments

SHA256 hash:	c98dbdfcc2c587c18cdaf96dfe08b6e263209aee9cc314d6b2d0e42ffcb1a0ed
SHA3-384 hash:	37c8215b75e265240b5cefa7fc0c6a6c3104ad9208c4bb9714fe9fdc07d6fd209d1992ef7dc181b646c55ce75767e1da
SHA1 hash:	ef34b4b9ea7cd95292eb03498ae992aee2ad3bf7
MD5 hash:	316dda7a47eea343a107386d020c146e
humanhash:	fillet-hydrogen-oxygen-oven
File name:	PURCHASE ORDER.zip
Download:	download sample
Signature	Formbook Create hunting rule
File size:	721'674 bytes
First seen:	2025-02-20 08:53:05 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:2Y8QPUZIUeMxu+ZHdLE0B9AfTudaf3b7V2Fvs+VKlgaq:2rIUCUpZH60B9AfTuduL7V2hh
TLSH	T143E42323DFC1A79D498CB4A67942CC52748E1FD44737DDB8AC25A3A03371F0862BAD96
Magika	zip
Reporter	cocaman
Tags:	FormBook zip

Intelligence

File Origin

# of uploads :

# of downloads :

522

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	FINAL DOCUMENT.exe
File size:	882'688 bytes
SHA256 hash:	0297c69a6525dcc36009ebcf3df69478f22e99d788dd81b1a26728c7acb663e9
MD5 hash:	0d0ec39d42ddf165923137c085390865
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win32.MalwareX-gen.17653.16203.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b6ee7c28ab76d43a5c2403

Tags:

virus shell msil

Result

Verdict:

Suspicious

File Type:

PE File

Link:

https://app.docguard.net/c98dbdfcc2c587c18cdaf96dfe08b6e263209aee9cc314d6b2d0e42ffcb1a0ed/results/dashboard

Verdict:

Suspicious

Labled as:

Troj/Krypt

Link:

https://www.hybrid-analysis.com/sample/c98dbdfcc2c587c18cdaf96dfe08b6e263209aee9cc314d6b2d0e42ffcb1a0ed

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/c98dbdfcc2c587c18cdaf96dfe08b6e263209aee9cc314d6b2d0e42ffcb1a0ed

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:my18 discovery execution rat spyware stealer trojan

Link:

https://tria.ge/reports/250220-mgp1javkz4/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Formbook payload

Formbook

Formbook family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c98dbdfcc2c587c18cdaf96dfe08b6e263209aee9cc314d6b2d0e42ffcb1a0ed

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_DIFF_Common_Strings_01 Create hunting rule
Author:	schmidtsz
Description:	Identify partial Agent Tesla strings

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Suspicious_Latam_MSI_and_ZIP_Files Create hunting rule
Author:	eremit4, P4nd3m1cb0y
Description:	Detects suspicious .msi and .zip files used in Latam banking trojan campaigns.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)