MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d566a5a84fd3148976960bd8b6c39f6a9dde3601b2f58ff81d743a9dba291249. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d566a5a84fd3148976960bd8b6c39f6a9dde3601b2f58ff81d743a9dba291249
SHA3-384 hash:	32ba6df3be0ca2a0bf87ed0510fde5174ac345046faeb3b927d2a88dbd3a906dee9b9dd67ee389cc830ddb76d4b1db93
SHA1 hash:	246758cb711efbc4c4f2907515358ee8782c65f0
MD5 hash:	77aa300f7678cf44ee7f0775b73d1fc4
humanhash:	salami-princess-fillet-apart
File name:	PMP-INS-93-2436-IN-1017.exe
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	390'125 bytes
First seen:	2023-10-18 12:40:12 UTC
Last seen:	2023-10-18 13:32:43 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f4639a0b3116c2cfc71144b88a929cfd (98 x GuLoader, 53 x Formbook, 39 x VIPKeylogger)
ssdeep	6144:xfL+oqPY2WFbg1WOPgjO5vK3nnThTn2B61PPA6zMhKBabRe/6GyBZ7UMyddkOY0C:xfLKYDFjOKIQx2BIA6pcwCGyBGdaQ8
Threatray	33 similar samples on MalwareBazaar
TLSH	T1D8841290FDAA8A62D89393310533F5921FB99C312694A3471384B96F7DF32D19A0B35F
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	fcd8d0d2dac0c0e4 (44 x Formbook, 1 x AgentTesla, 1 x XWorm)
Reporter	malwarelabnet
Tags:	exe FormBook

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

322

Origin country :

CA

Vendor Threat Intelligence

CAPE Sandbox Formbook

Detection:

Formbook

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/455685/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Gen.Variant.Ransom.Loki.17507.13697.24433.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Creating a process from a recently created file

Сreating synchronization primitives

Unauthorized injection to a recently created process by context flags manipulation

Dragonfly

Gathering data

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

control installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/652fd26110dbe5fb92cda749/reports/f148bee1-dfa1-47d5-b020-f88565c10ba3/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/d566a5a84fd3148976960bd8b6c39f6a9dde3601b2f58ff81d743a9dba291249

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Formbook

Malware family:

Formbook

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6a737f1e-128f-4445-9eb6-1573e57ad9a5

Joe Sandbox FormBook, NSISDropper

Result

Threat name:

FormBook, NSISDropper

Alert

Create hunting rule

Detection:

malicious

Classification:

n/a

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1327983

Signature

Antivirus detection for URL or domain

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected FormBook

Yara detected NSISDropper

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/d566a5a84fd3148976960bd8b6c39f6a9dde3601b2f58ff81d743a9dba291249

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d566a5a84fd3148976960bd8b6c39f6a9dde3601b2f58ff81d743a9dba291249/

ReversingLabs TitaniumCloud Win32.Trojan.InjectorX

Threat name:

Win32.Trojan.InjectorX

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-10-18 09:47:14 UTC

File Type:

PE (Exe)

Extracted files:

3

AV detection:

23 of 36 (63.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2vtklkcp2mkis5uwbpmlnq47nko54nqbwl2y76a5oq5j3orjcjeq._file

Threatray formbook

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

Similar samples:

2379a4e1ccdd7849ad7ea9e11ee55b2052e58dda4628cd4e28c3378de503de23

Formbook

84a957af4bee9e5f07b399e5a36ea6b59038e85d3efb2f0f6bd86de787f634ad

Formbook

925fa028b1511d9fb57e7f69efebff4c34228222af3adc11cfc45d930e9f6983

Formbook

a217b4594093f3db0e915ed2a5ed293683269e29af9b0d5a220dc813edfd19d4

Formbook

a61f90080667f49f558e5de7716f2f81cbbbe0b12b31fd7cf5aea45bfbb864b0

Formbook

dd53d18a4c884dba2710a5a6803e7d262e19ea2483ac526d5cca087edb318098

Formbook

e41ce47cf174f8b3f909756c90495e990b4f5550da4bd7e1a6b5ba50ba0ba9e9

Formbook

e823e333ce86a2ac88338d4be5d78fd5901ce23e789b37e23ce22a29b550e324

Formbook

+ 23 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/231018-pwr5jsga28/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UnpacMe win_formbook_w0 win_formbook_g0

Unpacked files

SH256 hash:

ac4617ee8fbcafc9d8eadda0ffcec203ab1aa8fe7a4af07701c4f0773ab5ecde

MD5 hash:

4b9d60a03eb3fd58ab93bedf456d933d

SHA1 hash:

3fd79921ffbad98ce954092660432f2459926028

Detections:

win_formbook_w0

Alert

Create hunting rule

win_formbook_g0

Alert

Create hunting rule

Link:

https://www.unpac.me/results/7cc75e59-2f0f-439d-b21f-c785bc901dbf/

SH256 hash:

d566a5a84fd3148976960bd8b6c39f6a9dde3601b2f58ff81d743a9dba291249

MD5 hash:

77aa300f7678cf44ee7f0775b73d1fc4

SHA1 hash:

246758cb711efbc4c4f2907515358ee8782c65f0

Link:

https://www.unpac.me/results/7cc75e59-2f0f-439d-b21f-c785bc901dbf/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d566a5a84fd3/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d566a5a84fd3148976960bd8b6c39f6a9dde3601b2f58ff81d743a9dba291249

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/455685/