MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d02ef9df3bc1af2c02ad5a9904ea604a55a6a93b5e08ca518232b96fec13882f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 12
| SHA256 hash: | d02ef9df3bc1af2c02ad5a9904ea604a55a6a93b5e08ca518232b96fec13882f |
|---|---|
| SHA3-384 hash: | 9b8c6447dbccdab2a4d4d4e9207203a8f20a7ae92f1f2737672f208d14c8be3011c054ce11381b79cb03ded4f23d34f8 |
| SHA1 hash: | 900a5bf8577de33382ccc8aa6c58951b13269b41 |
| MD5 hash: | 14f4905b091377c4e741f78e33031fb2 |
| humanhash: | october-oscar-paris-emma |
| File name: | NGL 3100 . URGENT OF202205635.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 769'536 bytes |
| First seen: | 2023-04-20 06:45:39 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'750 x AgentTesla, 19'656 x Formbook, 12'248 x SnakeKeylogger) |
| ssdeep | 12288:z6nweiC6xObLVMJXUIxxxS1P+Ud/e8slkdbG7xflFPqdn4H2oXs+/Uozh6TPAIBa:z6dn6OFc81mwcEalNF+to0ots3Bjab |
| Threatray | 2'605 similar samples on MalwareBazaar |
| TLSH | T1C0F4D05DBA98B65EC59B8E3688541C50937164AB870BE347A98F129CDD0E39BCF003F7 |
| TrID | 59.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.6% (.SCR) Windows screen saver (13097/50/3) 8.5% (.EXE) Win64 Executable (generic) (10523/12/4) 5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.0% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| File icon (PE): |  |
| dhash icon | f0b2b2b2c4707068 (2 x Formbook) |
| Reporter |  lowmal3 |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
246
Origin country :
DEVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
NGL 3100 . URGENT OF202205635.exe
Verdict:
Malicious activity
Analysis date:
2023-04-20 06:47:19 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
hacktool packed
Verdict:
Malicious
Labled as:
Tedy.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Signature
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.GenKryptik
Status:
Malicious
First seen:
2023-04-19 00:14:53 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
19 of 22 (86.36%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'595 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
50d375d039b81b3f2abc9da7d866ada6d600ffc58274413ec1a4573439eb2e3a
MD5 hash:
9dd289bc345e6e01c6f0e69bcdd1ef3e
SHA1 hash:
11d7773861e887c09961f9e9632200ccc73baf28
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
cc05c5a52e169abc5033c80c5c5c9b4bb3ceb451ee3afe816e17c8fe00e28d24
MD5 hash:
ea74c2e435710fe5727e02b97d578468
SHA1 hash:
d635ea803de96e5ea4d4d9e70427e2c4e9ff3a14
SH256 hash:
fbf35ecb2ebade4bd3fcccbf522edd2879e78ce8d4753eb0702f52d8a7c0837d
MD5 hash:
130fe095ce2bf6a03203e46422c122e2
SHA1 hash:
fedc10c7be95ae0b07f2166a2f87ab1844318a06
SH256 hash:
f95f96a1afae464f95c4322230505ec64c60cc6c8e1871791c7f5b8634aa5199
MD5 hash:
73ae6845b15f739c8f6e870575616062
SHA1 hash:
a49ea5b2e341d1ca8ea7d9d148293a158475d773
SH256 hash:
4eac87d6896bdc619f9fc80b30fa1e2bf095ffca08c653161538858cd263b572
MD5 hash:
129294d744dd031f97a7ee455084a085
SHA1 hash:
6f7e99964ce0ff652e8a662970b589eb14db1450
SH256 hash:
d02ef9df3bc1af2c02ad5a9904ea604a55a6a93b5e08ca518232b96fec13882f
MD5 hash:
14f4905b091377c4e741f78e33031fb2
SHA1 hash:
900a5bf8577de33382ccc8aa6c58951b13269b41
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.