MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4460adada9326e90bbbe95f5cfc50efdbc315fa177152a92dde48e50fa3887b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d4460adada9326e90bbbe95f5cfc50efdbc315fa177152a92dde48e50fa3887b
SHA3-384 hash:	6737414599e6ebc79308ad687db7398fae29ec13d549eefa4d96fdca3e4890674c4a52e4e3d09055c6893276a8a28368
SHA1 hash:	9008145de01f73d91bac8e12b04034945682df86
MD5 hash:	4bdc3c4e9eb0e4e9a16508af845a3e57
humanhash:	shade-bluebird-jig-alabama
File name:	Documents.zip
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	554'469 bytes
First seen:	2023-12-20 14:52:34 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:r2v8t4IDJrF71hGR2WrROq1gm2LVLP4d3WgL7/RNTq3X0Xk7eK:ykt4k71oRNrUqihAdL9c3X0XmeK
TLSH	T195C4234DC42DE20D963F65AF5AE7CFED154BD491B1EE7328B69A410B2738E3E819D200
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	FormBook INVOICE zip

cocaman

Malicious email (T1566.001)
From: "Info <info@sc.com>" (likely spoofed)
Received: "from sc.com (unknown [91.92.252.186]) "
Date: "20 Dec 2023 06:51:23 -0800"
Subject: "Re: order Invoice"
Attachment: "Documents.zip"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

201

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Documents.exe
File size:	781'824 bytes
SHA256 hash:	7bacfc4148055cac9beba5517630e42a46ca8689bc8e6fd1bb25831e43e58582
MD5 hash:	8236ed91c917687d4cb9baa9b2e6ec1d
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Zip_fs2920.UNOFFICIAL

Alert

Create hunting rule

Porcupine.Malware.58887.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Trojan.MulDrop24.34313.15798.9118.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.24904.ZipHeur.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6582ffd2f4b6e5e16351f19f/reports/6bfa5877-21ea-4dff-bf3e-67ca2ce4a101/overview

Hybrid Analysis Troj/Krypt

Verdict:

Malicious

Labled as:

Troj/Krypt

Link:

https://www.hybrid-analysis.com/sample/d4460adada9326e90bbbe95f5cfc50efdbc315fa177152a92dde48e50fa3887b

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/d4460adada9326e90bbbe95f5cfc50efdbc315fa177152a92dde48e50fa3887b

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

Archive

Link:

https://malprob.io/report/d4460adada9326e90bbbe95f5cfc50efdbc315fa177152a92dde48e50fa3887b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d4460adada9326e90bbbe95f5cfc50efdbc315fa177152a92dde48e50fa3887b/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-19 13:04:40 UTC

File Type:

Binary (Archive)

Extracted files:

13

AV detection:

20 of 23 (86.96%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2rdavww2smtosc535fpvz7cq57n4gfp2c5yvfkjn3zeokd5drb5q._file

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook campaign:gd12 rat spyware stealer trojan

Link:

https://tria.ge/reports/231220-tsg8dscbe4/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Formbook payload

Formbook

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/d4460adada9326e90bbbe95f5cfc50efdbc315fa177152a92dde48e50fa3887b