MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d5fc5fba51a492858f45d0f86b010ac6ab2bc68be94fc2c8a776b7eaf3acaac3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | d5fc5fba51a492858f45d0f86b010ac6ab2bc68be94fc2c8a776b7eaf3acaac3 |
|---|---|
| SHA3-384 hash: | e28d2f6b191395660f9d18a192e9f4b074637c8dbefe5fc92a8655304e0aa71362fd0692e2ebfc31aa1f28ebed6a1e6f |
| SHA1 hash: | 22b98e378b0ecd97f518077b232d3e6ecd800f0e |
| MD5 hash: | f22d31337659a931cc02f8b0000bbf8b |
| humanhash: | cup-fillet-idaho-robert |
| File name: | Project UAE_UNIVERSITY.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 661'504 bytes |
| First seen: | 2023-04-03 05:55:19 UTC |
| Last seen: | 2023-04-03 06:34:05 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:Xv+tzLwrqWuJ5lv9cYtvlovOtgVAJ8TTM4eJJEh+RBsANL/vyhIoPOYFW:ZHG5lFteOyjXM4eJJEKNLXy |
| Threatray | 2'432 similar samples on MalwareBazaar |
| TLSH | T145E41249362C592FCD9D85FEB1F1014A47BAC931762BC7E51CC8A8EE6EE3F444406A87 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer) |
| Reporter |  adrian__luca |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
238
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Project UAE_UNIVERSITY.exe
Verdict:
Malicious activity
Analysis date:
2023-04-03 06:02:26 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.FormBook
Status:
Malicious
First seen:
2023-04-03 03:15:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
16 of 36 (44.44%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'422 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
c39085f9c5a6ac4162e83d3864f90df28da021fd14984e272f5d594122586853
MD5 hash:
1cfc79612d5d7f489795ef255af526e3
SHA1 hash:
97413c60471531cbac0ed6d9a8f3ecbd805da480
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
19a606ebbe75dead710e74fe1956a0402e44b7ba4ca4b919b8ca29d7245ec636
MD5 hash:
8c26f73fee5c7c2f3b0abef5aad0560b
SHA1 hash:
061a91535924de4f3fd3722529a78740c125d2cf
SH256 hash:
0ce850b179c259462b579a84dd981a348c37747cf46a8bd08c23f52f784e892e
MD5 hash:
74b287fb9ef30b3e2e4494295c4d6a2d
SHA1 hash:
d160503b48bb80945798d0274ca06c0bf363db57
SH256 hash:
4a99d7410d49896bbb93e876d3049621c77d21ec28d19599a35441a30a48a7a7
MD5 hash:
958c99864010671544febf535434cdd4
SHA1 hash:
9659ac112bd2345b7cc12053382d70dacad5955b
SH256 hash:
3c507afadbb1c31a9ebdd24baac5739d47576159e01c5e84f973c951885100aa
MD5 hash:
e79bf0e7e9d52d398e0b23b352394c68
SHA1 hash:
682325763a0ec77e0fd475ea3a4021b4651eceac
SH256 hash:
3b27c3d09ed2a19079a5d8c55ec28aaa4a6ed80135711bc58138be16b7e4aea6
MD5 hash:
6f143fb49fdcec9e2bcc2c04f7b36d63
SHA1 hash:
0106c8430a1a09d591376317b0c7d34fa3d4da9d
SH256 hash:
d5fc5fba51a492858f45d0f86b010ac6ab2bc68be94fc2c8a776b7eaf3acaac3
MD5 hash:
f22d31337659a931cc02f8b0000bbf8b
SHA1 hash:
22b98e378b0ecd97f518077b232d3e6ecd800f0e
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Suspicious_Macro_Presence |
|---|---|
| Author: | Mehmet Ali Kerimoglu (CYB3RMX) |
| Description: | This rule detects common malicious/suspicious implementations. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.