MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4f92eedf4a8eb72f4825a974b88d094fe8ec8604d18735602536060e65a471b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4f92eedf4a8eb72f4825a974b88d094fe8ec8604d18735602536060e65a471b
SHA3-384 hash: 78989c30252e1a5a315fa798eb49461f3ef3b243361863b1636ae316aa8773770bed2bf46ed4d724c1fc857ef5bc9f62
SHA1 hash: 167a1b36b2e464c02ead85814c725eb881469b24
MD5 hash: 933acd02ce8117cd6cdc309770d8fbb5
humanhash: comet-eighteen-oscar-pluto
File name:cd6f0b4113eecd57b184247a76145f72.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:171'520 bytes
First seen:2020-04-02 03:55:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:MR51YTXPiJR5m+SPxj4I0OWTA5QCPx52CTCjZBnzSr:wsWJMPxV0LTA5QCPilJ+r
Threatray 4'512 similar samples on MalwareBazaar
TLSH EBF3BF32D641C431E2B201B5B67D0B7B883D4E343695A5F6E3E02AE06FB44A5B56E31F
Reporter abuse_ch
Tags:exe FormBook GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1vNRNjGF4nyVLtIPw_amI0PWRIq385oWf

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Win.Malware.Formbook-7399661-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Formbook
Create hunting rule
Status:
Malicious
First seen:
2020-04-02 04:35:49 UTC
File Type:
PE (Exe)
AV detection:
43 of 47 (91.49%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2t4s53puvdvxf5eclkluxcgqst7i5sdajumhgvqcknqgbzs2i4nq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
0005e5022cd608e05426c717720cab930b17de32f9afde7af7db5bff68db21ea
FormBook
223bbe1af0d09289a1ebeddf78e3218fcae28d0a69c291d66fee5fa29337844a
FormBook
49b83750fc8ffbfd1a1e0c11be6eb327159fdeb0e8c20820844fd3af2d96c2f2
FormBook
8724cbdd787358fa70708cd785ab59acbdfdd7b7e31c1b877d92feeeb7504f0a
FormBook
9727c687448fb19944524631d76df2facf3fdb70324e2c61d535756fcd838ddb
FormBook
ccfcf14bca2ebfe80aa2c5cfa4cf42330925665faa0b6300098c4d36f1c01695
FormBook
ebfc26187e0b0ad6924461b1f2476321c53b5a23fbfe246e3ed5a475a1ea5678
FormBook
f38d170b1da421aa60e778a64fec953d3058336f7cb06568ba7926495fe87f0c
FormBook
fabdc8295e6fe5127deac9b2854b28d0132d9eaac091f89652919fbd1f8ec863
FormBook
fef2f8121d80af16a1fbc65d419096960e10bcd8c29a179afd0dc4140d8a0fc9
FormBook
+ 4'502 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

5ad7f958b382b25cd6548572e47017664418ee90b7d4837f4e2dc9f16699a075

FormBook

Executable exe d4f92eedf4a8eb72f4825a974b88d094fe8ec8604d18735602536060e65a471b

(this sample)

  
Dropped by
MD5 cd6f0b4113eecd57b184247a76145f72
  
Dropped by
MD5 fdc755a7c5fe1011d5b2aaaa48c9493f
  
Dropped by
GuLoader
  
Dropped by
SHA256 5ad7f958b382b25cd6548572e47017664418ee90b7d4837f4e2dc9f16699a075
  
Dropped by
SHA256 31badd31aab397213b3376723a42d665c40b76d039c4be9708eab7c3ab1db1de
  
URLhaus
https://urlhaus.abuse.ch/url/333883/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments