MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3176a7c1da504f8fc476ecd609f45298eb4bd9d807aec3498c856a7ff750212. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3176a7c1da504f8fc476ecd609f45298eb4bd9d807aec3498c856a7ff750212
SHA3-384 hash: 0d6a430c921db5482c71c2cf27c9da3603dc8f3a8a08ad4c8478858c9f3f13920c544a87c3ea9bc4496bd09d1acb208a
SHA1 hash: 3e58b7b6fb9e2a4c41b4c7cf08626b1a41cd5e2e
MD5 hash: 6471c0a46b39e387da799e9137824933
humanhash: music-minnesota-east-eight
File name:PALLET MOLD OFFER ENQUIRY.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:899'072 bytes
First seen:2022-03-11 12:16:17 UTC
Last seen:2022-03-11 13:42:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:xcx+8a0aRue+QVt65souj7hpLjgalrWs+WkwMCp/FKnY0o87BwztfJx4CbKf0oaG:GxeQeBKnW4Cp/qiJrK8oai/1w0A
Threatray 13'110 similar samples on MalwareBazaar
TLSH T1F3157CE0AB08867EDC16623AC07949B31DA35A4D6C247F0D658D7E8E2D637CF04A785F
File icon (PE):PE icon
dhash icon 6cecccccb4c2f2b2 (38 x AgentTesla, 30 x Formbook, 24 x PythonStealer)
Reporter TeamDreier
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
228
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/249410/
Detection(s):
SecuriteInfo.com.Trojan.Siggen17.22871.29287.20041.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Unauthorized injection to a recently created process
Creating a file
Searching for synchronization primitives
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/622b3dc90cd58dbd927df9ba/reports/21463a52-bc78-4d57-b1f4-38163ca8b10b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ec1559ce-ba4c-4021-ac2b-ec0980941d77
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/954843
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d3176a7c1da504f8fc476ecd609f45298eb4bd9d807aec3498c856a7ff750212/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-11 05:29:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
24 of 27 (88.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2mlwu7a5uucpr7chn3gwbh2ffghljpm5qb5oyneyzblkp73vaija._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
03231087b8d197ac9adff7250c8ceb9c1e6d604c008e5622de78d7e1fcc78c1c
Formbook
49f94b3fbaf875cb2c223cdee59cfdedf4b2b937fba4a473cf2e4f767b44cb4c
Formbook
67435ee3c6fd3d272c004256f34020df37fb93fd33c18720053b9d2c1bb19b67
Formbook
8ea742e271b371fe424d1e2cb3f5227c6a0f2af70161f5c7600148228e2d77c1
Formbook
9cd0bbacb06bc4a961772ad5dac574736247fa7604116855118ecabb6926643b
Formbook
adf7fa31e3f65111c002c0cd54c049a05c2327a7d9956f41aa7c7f0f069d4263
Formbook
b2a2c2200f389dd11ed8083225880c75a050ab463146117e7aa02b983210a6f8
Formbook
e1a56f989b55a3ca7b2c531fae84dce7bb3dfd4f20c2d317894337f41d6e85e1
Formbook
ebae4c196d8a58491f149c1f561b8dfcb7286b5b5e14ee85bd2393a968a498b9
Formbook
+ 13'100 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:mqr7 loader rat
Link:
https://tria.ge/reports/220311-pf2n2shdc2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Blocklisted process makes network request
.NET Reactor proctector
Xloader Payload
Xloader
Unpacked files
SH256 hash:
4dcf989840d1b8d99745fb8551b28e9b192aef4e45a3dd25046c736ecf73dba0
MD5 hash:
cfaf80bc345c0ddec84ee915fca92e2e
SHA1 hash:
df7f718f70a76aaa44fd664aade5c5c98b9039f5
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/dc85a63a-df9e-40f9-8646-3cdec72119dc/
Parent samples :
502bd048ca66ac44a6ee60d4737e1b9fc5749bf3e665645e9da6039bdf399ba7
08edf460b335177ee1b7000d570443e65ff915665da55e7f11c9042d1850b73e
db791b3ac13d1bd18a2fb7925487e736cea8b932f9f3396e8758502331bb9162
3e112c8cbe72051b1c0ca82e1cd85181948c60427a89d6048c12e878c6c29b65
9cd0bbacb06bc4a961772ad5dac574736247fa7604116855118ecabb6926643b
d3176a7c1da504f8fc476ecd609f45298eb4bd9d807aec3498c856a7ff750212
SH256 hash:
c639313372fa5b5ba50aef09f7fa3b302718adeb36c010f37918e95c8431e8c4
MD5 hash:
e4115394c4e8bbd4d41722462fd26a88
SHA1 hash:
5fdd37c46f9437304e9bc69905af0af765e04bfb
Link:
https://www.unpac.me/results/dc85a63a-df9e-40f9-8646-3cdec72119dc/
SH256 hash:
9b00e2fa33ad72dec22a5e107ab6886da72bbe0bed89a721e877c1dc3ce6a662
MD5 hash:
b4c9c16228f0ee1de70ffc6264fb720c
SHA1 hash:
437049e452a511e220abdb32df695cdf07f5a7d0
Link:
https://www.unpac.me/results/dc85a63a-df9e-40f9-8646-3cdec72119dc/
SH256 hash:
0fd9767b8a27aae0a7dbdc838c490b23303e335f53ef0e7b115930a5b605b131
MD5 hash:
85a5b08520944a1dab3d541a4f3b2754
SHA1 hash:
2d3027136a02eb3992b80cb08f45d08a426d3ce9
Link:
https://www.unpac.me/results/dc85a63a-df9e-40f9-8646-3cdec72119dc/
SH256 hash:
d3176a7c1da504f8fc476ecd609f45298eb4bd9d807aec3498c856a7ff750212
MD5 hash:
6471c0a46b39e387da799e9137824933
SHA1 hash:
3e58b7b6fb9e2a4c41b4c7cf08626b1a41cd5e2e
Link:
https://www.unpac.me/results/dc85a63a-df9e-40f9-8646-3cdec72119dc/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d3176a7c1da5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/d3176a7c1da504f8fc476ecd609f45298eb4bd9d807aec3498c856a7ff750212

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe d3176a7c1da504f8fc476ecd609f45298eb4bd9d807aec3498c856a7ff750212

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/249410/

Comments