MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfbd66845ba87ca332833515563aaf417025692ad4f341567b7bd11a509c06d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfbd66845ba87ca332833515563aaf417025692ad4f341567b7bd11a509c06d9
SHA3-384 hash: fbc310e049aadec9ac05c47e4a4a5532a393f36e8f65986a46c753a4611c97da2c94fc59e89a2a300c6a607fea08bd7d
SHA1 hash: 6692bf6a3be63de739d7bc2cbf73e5fdd17d0e59
MD5 hash: bc0a9468b9de7354e369b021ec50cc1e
humanhash: romeo-beer-chicken-table
File name:Efte9.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:106'496 bytes
First seen:2020-05-07 12:08:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a1759e31312031fcef56424d2cae7604 (1 x Formbook)
ssdeep 1536:lBaM2DnUJmxH2Qlae9MLSSriGkibTpUiUakUzN:Wg7riGkGpx
Threatray 5'105 similar samples on MalwareBazaar
TLSH 54A3C944AAE4EC17D5BAB9B1D791F6DEC3895C326031150375C0320B4F71982AFA1B7E
Reporter jarumlus
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 12:36:36 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z66wnbc3vb6kgmudgukvmovpifyck2jk2tzucvt3ppiruue4a3mq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1ffe8a0c22c433b676f40639e236a1c7cc58656be5150f1bd4dc7f24d807c761
Formbook
2a11f8f83b6c7fc23742f76d10d013aef543026557ddcd62879a638f6fd00c52
Formbook
3bd58e3b3fe712e8d7595cfbd576a96251c68a5dac230bd3e778640e8eb817ec
Formbook
6b307cbe4f1e8d769af95142d574e77a50654e25cce234f48da6c5e7a7aa4b99
Formbook
6f95416c1006a499c7012c6cde49a27f83223c665cf9b28764030afeb04bf697
Formbook
83968322ee41293c915a37779c384b39d1a0429303ed831291da984e7ff6877f
Formbook
8606768cb758ba8379659f65220250ebc1c491dabd668e7f98663571419cadf2
Formbook
8842ac3497c777517b2f18152eabaa0994a460d249773a5e89a4e16bca2bd741
Formbook
9847005465ae681d1d9533697106492027a1d55b64b0ca1b6f2a79730a5140a4
Formbook
eca4673c4308cb6dfd3757fcda824d93b7076fa2b2e7b2912863cdc4cb3f422e
Formbook
+ 5'095 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-vjk4dxh7f2/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Word file doc 1ffe8a0c22c433b676f40639e236a1c7cc58656be5150f1bd4dc7f24d807c761

Formbook

Executable exe cfbd66845ba87ca332833515563aaf417025692ad4f341567b7bd11a509c06d9

(this sample)

  
Dropped by
MD5 b5dc38b791076c31153ff6310b928113
  
Dropped by
SHA256 1ffe8a0c22c433b676f40639e236a1c7cc58656be5150f1bd4dc7f24d807c761
  
Delivery method
Distributed via e-mail attachment

Comments