MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cdf49d3ed765a56d0b223974bdd2d378fef0e62671532fc4d6519f96d402a9cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	cdf49d3ed765a56d0b223974bdd2d378fef0e62671532fc4d6519f96d402a9cd
SHA3-384 hash:	fc0811bd9363ee26a45598236ef8e221aa28dde2edaed0cdd160ec99e42653078424ede9892d0ace5d82884a9d2f65a4
SHA1 hash:	12a4190f5859a7b4fbd8bd12dc6c5a4c0a669f52
MD5 hash:	ff190f9b3884938e9c546a33e723c8f5
humanhash:	timing-nuts-april-eighteen
File name:	shipping document_pdf.gz
Download:	download sample
Signature	Formbook Create hunting rule
File size:	559'030 bytes
First seen:	2022-11-10 08:57:32 UTC
Last seen:	Never
File type:	gz
MIME type:	application/gzip
ssdeep	12288:8u2SjsP5fNCle4WXGkIqDKLWIE0zx1BRxbPWxy2YUp:sGyJNCluXGrq+LLJ7zxbuU2YUp
TLSH	T1ACC423C825D46FDCE0FBB376606E40366934F91B995B761281F9E09EFE287045403E9E
Reporter	cocaman
Tags:	FormBook gz Shipping

cocaman

Malicious email (T1566.001)
From: "COSCO SHIPPING INC <mil.sha@cobertas.com>" (likely spoofed)
Received: "from rjblxrgl.cobertas.com (rjblxrgl.cobertas.com [92.52.217.58]) "
Date: "Thu, 10 Nov 2022 08:48:18 +0100"
Subject: "ORIGINAL B/L DOCUMENT / PL"
Attachment: "shipping document_pdf.gz"

Intelligence

File Origin

# of uploads :

# of downloads :

147

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	shipping document_pdf.exe
File size:	781'312 bytes
SHA256 hash:	9b4df9f66fdc83879d2ce5c5077f51e0ca02af50050fdeaccaca982bc0c59b52
MD5 hash:	17afae8266f4de31b69aa5bde0892dad
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed rundll32.exe

Link:

https://www.filescan.io/uploads/636cbd1b5ae98d577068a930/reports/049ebc78-14b6-4544-bf96-3538a4b03d31/overview

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cdf49d3ed765a56d0b223974bdd2d378fef0e62671532fc4d6519f96d402a9cd/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-11-10 08:03:01 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

18 of 41 (43.90%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zx2j2pwxmwsw2czchf2l3uwtpd7pbzrgofjs7rgwkgpznvacvhgq._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:sy01 rat spyware stealer trojan

Link:

https://tria.ge/reports/221110-ld6y7saedj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Deletes itself

Formbook payload

Formbook

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/cdf49d3ed765a56d0b223974bdd2d378fef0e62671532fc4d6519f96d402a9cd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.