MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf33cf1b99aec2e58ebff495b327734f9d444884af6846ea086c210bd4ee2623. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf33cf1b99aec2e58ebff495b327734f9d444884af6846ea086c210bd4ee2623
SHA3-384 hash: c016f27ba65322d834710e75834bb03584ae655b482391f6f08feadc10bc19684cd9613be364a6862ef40e9d83e52748
SHA1 hash: 5d3e07d0d41fd3e16d4f9cde32362120e5f2c8a2
MD5 hash: e344bda7899df6fb9d12560254d07a13
humanhash: east-wisconsin-low-kilo
File name:Shipment Document BL,INV and packing list.jpg.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:320'549 bytes
First seen:2023-11-15 07:39:10 UTC
Last seen:2023-11-16 15:33:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:wBlL/9pMUHq5ivHw521qti+5WmKasPxo9Rge/LAx9EUEgno9TF0KB:C/+UHq5mSDBK3a9GY8EUFnQF/B
Threatray 351 similar samples on MalwareBazaar
TLSH T13864122474E0C8F7D4E24A735F7ADF61C3F8A651252492CB57604FBF0E46DE2621B681
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter cocaman
Tags:DHL exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
376
Origin country :
CH CH
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/458671/
Detection(s):
SecuriteInfo.com.Trojan.Garf.Gen.10.1221.22334.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control installer lolbin masquerade overlay packed shell32
Link:
https://www.filescan.io/uploads/655475d48dc4c0f2230b4b49/reports/75492bce-0a8f-46e6-a6da-5ef933fc9c18/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/cf33cf1b99aec2e58ebff495b327734f9d444884af6846ea086c210bd4ee2623
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/301fff6c-97b6-4983-a451-3b6e4fae5432
Result
Threat name:
FormBook, NSISDropper
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1342838
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample has a suspicious name (potential lure to open the executable)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected FormBook
Yara detected NSISDropper
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1342838 Sample: Shipment_Document_BL,INV_an... Startdate: 15/11/2023 Architecture: WINDOWS Score: 100 34 www.babkacuisine.xyz 2->34 36 www.xlookcoins.top 2->36 38 9 other IPs or domains 2->38 54 Snort IDS alert for network traffic 2->54 56 Found malware configuration 2->56 58 Malicious sample detected (through community Yara rule) 2->58 62 10 other signatures 2->62 12 Shipment_Document_BL,INV_and_packing_list.jpg.exe 17 2->12         started        signatures3 60 Performs DNS queries to domains with low reputation 34->60 process4 file5 32 C:\Users\user\AppData\...\inqvcprugn.exe, PE32 12->32 dropped 15 inqvcprugn.exe 12->15         started        process6 signatures7 72 Detected unpacking (changes PE section rights) 15->72 74 Machine Learning detection for dropped file 15->74 76 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 15->76 78 2 other signatures 15->78 18 inqvcprugn.exe 15->18         started        process8 signatures9 46 Modifies the context of a thread in another process (thread injection) 18->46 48 Maps a DLL or memory area into another process 18->48 50 Sample uses process hollowing technique 18->50 52 Queues an APC in another process (thread injection) 18->52 21 explorer.exe 7 1 18->21 injected process10 dnsIp11 40 www.lasermywords.com 172.67.162.221, 49740, 80 CLOUDFLARENETUS United States 21->40 42 www.bbtyss.top 172.67.170.5, 49741, 80 CLOUDFLARENETUS United States 21->42 44 4 other IPs or domains 21->44 64 System process connects to network (likely due to code injection or exploit) 21->64 25 svchost.exe 21->25         started        signatures12 process13 signatures14 66 Modifies the context of a thread in another process (thread injection) 25->66 68 Maps a DLL or memory area into another process 25->68 70 Tries to detect virtualization through RDTSC time measurements 25->70 28 cmd.exe 1 25->28         started        process15 process16 30 conhost.exe 28->30         started       
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cf33cf1b99aec2e58ebff495b327734f9d444884af6846ea086c210bd4ee2623
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cf33cf1b99aec2e58ebff495b327734f9d444884af6846ea086c210bd4ee2623/
Threat name:
Win32.Trojan.BazarLoader
Create hunting rule
Status:
Malicious
First seen:
2023-11-15 07:39:13 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z4z46g4zv3boldv76sk3gj3tj6ouiseev5uen2qinqqqxvhoeyrq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
43141e46fdafbf6529ef4319ee733ef308a6e6e12278e74c135d977a5b135876
Formbook
6467245f6d186b2dd54ba139a2bd8ea38cafe83952d7c20cd0937c53b9e9cb6a
Formbook
a0a6a1c54775713ad3e884b6bc49f2c74f393464a69175c8713221504ae6d72a
Formbook
c1aa65f7c2cc6beb7052c8ada46a3139fc01da66890f4153a7c5761292b71d61
Formbook
f36f3336aedc47e7ec061cc5a11589d9e3adcff96bbc805a8da7ac0182d40e22
Formbook
+ 341 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:fs35 rat spyware stealer trojan
Link:
https://tria.ge/reports/231115-jhh2tsff51/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
Formbook payload
Formbook
Unpacked files
SH256 hash:
ebb46bf819d57e643e831c8cd436414a8961ab6112a7a4ce580fcf23e455030b
MD5 hash:
c90142f38b1efda69b3c2af1ad87f5ae
SHA1 hash:
3b34c8e64904987cd75b1a7b09105a39dc66f473
Detections:
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Formbook
Create hunting rule
Link:
https://www.unpac.me/results/780997e1-48b6-42c4-b577-1cfa3ef9b6bd/
Parent samples :
6467245f6d186b2dd54ba139a2bd8ea38cafe83952d7c20cd0937c53b9e9cb6a
f36f3336aedc47e7ec061cc5a11589d9e3adcff96bbc805a8da7ac0182d40e22
43141e46fdafbf6529ef4319ee733ef308a6e6e12278e74c135d977a5b135876
cf33cf1b99aec2e58ebff495b327734f9d444884af6846ea086c210bd4ee2623
6d8288a0edeabb4ce9889e7effa3983f1b300d49082e5eed5e8d9d256b4e2367
SH256 hash:
7eff5b01cff641f7b8c5219920e108630c4a3fee826cf8daa2ec0ea489ac5d85
MD5 hash:
ad855d2040a187a78ed564f13a87602b
SHA1 hash:
aaa46529f775718f1eddbd7cdc4f2599732d1c4d
Link:
https://www.unpac.me/results/780997e1-48b6-42c4-b577-1cfa3ef9b6bd/
SH256 hash:
cf33cf1b99aec2e58ebff495b327734f9d444884af6846ea086c210bd4ee2623
MD5 hash:
e344bda7899df6fb9d12560254d07a13
SHA1 hash:
5d3e07d0d41fd3e16d4f9cde32362120e5f2c8a2
Link:
https://www.unpac.me/results/780997e1-48b6-42c4-b577-1cfa3ef9b6bd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cf33cf1b99aec2e58ebff495b327734f9d444884af6846ea086c210bd4ee2623

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

ace 4b0088a5ea5b554b183064229db63803bac5538cd7cb9f5f1092e50dce0d4ade

Formbook

Executable exe cf33cf1b99aec2e58ebff495b327734f9d444884af6846ea086c210bd4ee2623

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 4b0088a5ea5b554b183064229db63803bac5538cd7cb9f5f1092e50dce0d4ade
Cape
Cape
https://www.capesandbox.com/analysis/458671/
  
Dropped by
MD5 54931739285550801a5dfb08b1aa5413

Comments