MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d68888aa1e155ac65bd1ddabcf05f61bfff65f79a11cc0ee099200c3da8c5d35. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d68888aa1e155ac65bd1ddabcf05f61bfff65f79a11cc0ee099200c3da8c5d35
SHA3-384 hash: 8dc36faa6ce85160fc2ffb7038a9c7d72338221ed428a5736b114e3142aea716e230fed2dbd635e79d1a214ad1cc9d21
SHA1 hash: 372ec6b31bc9d7bde1545927807ad71326473162
MD5 hash: c04e9037beabc65baa9e3aa9bd693c1a
humanhash: venus-tennessee-romeo-iowa
File name:Project.pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:687'616 bytes
First seen:2021-02-12 13:56:44 UTC
Last seen:2021-02-17 15:30:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:0EEfrEZi9701LYBFwMRs8bslUVy8dJFBZHIAvYh+:xZHEfZRs8bJVy8TD9IWy+
Threatray 3'747 similar samples on MalwareBazaar
TLSH FCE4D026175CEF11E27E1BBBC8B4942093FCEC029A26C65F6DF839CC1471FD8A661646
Reporter GovCERT_CH
Tags:FormBook

Intelligence

File Origin
# of uploads :
13
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Project.pdf.ace
Verdict:
Malicious activity
Analysis date:
2021-02-12 08:43:19 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/c9b392dc-da0a-45b0-8851-e8cf763f4320

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/116930/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.45715702.8688.12631.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/606810
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Suspicious Double Extension
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 352437 Sample: Project.pdf.exe Startdate: 12/02/2021 Architecture: WINDOWS Score: 100 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 11 other signatures 2->45 10 Project.pdf.exe 3 2->10         started        process3 file4 29 C:\Users\user\AppData\...\Project.pdf.exe.log, ASCII 10->29 dropped 55 Tries to detect virtualization through RDTSC time measurements 10->55 14 Project.pdf.exe 10->14         started        signatures5 process6 signatures7 57 Modifies the context of a thread in another process (thread injection) 14->57 59 Maps a DLL or memory area into another process 14->59 61 Sample uses process hollowing technique 14->61 63 Queues an APC in another process (thread injection) 14->63 17 explorer.exe 14->17 injected process8 dnsIp9 31 www.criacoesvicla.com 154.213.241.19, 49748, 80 POWERLINE-AS-APPOWERLINEDATACENTERHK Seychelles 17->31 33 towatchapp.com 151.101.1.195, 49750, 80 FASTLYUS United States 17->33 35 4 other IPs or domains 17->35 47 System process connects to network (likely due to code injection or exploit) 17->47 21 control.exe 12 17->21         started        signatures10 process11 dnsIp12 37 www.xiaoxu.info 21->37 49 Modifies the context of a thread in another process (thread injection) 21->49 51 Maps a DLL or memory area into another process 21->51 53 Tries to detect virtualization through RDTSC time measurements 21->53 25 cmd.exe 1 21->25         started        signatures13 process14 process15 27 conhost.exe 25->27         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d68888aa1e155ac65bd1ddabcf05f61bfff65f79a11cc0ee099200c3da8c5d35/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-12 09:35:27 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=22eirkq6cvnmmw6r3wv46bpwdp77mx3zueomb3qjsiamhwumlu2q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0db69eb6654d1090cb17ab58537a7304e2c269613c0edabf123cf230d289db73
Formbook
5c7b804890877a7a9da085d878b0fc1a444aa1b75965e16beab74c978fab6079
Formbook
6a7659b4614c990d4feba15eeef035d47dcb8f46d92320620205eb6131eaf6a4
Formbook
867ec49152a23a8e5ea628a48ec1810db588a716b922e6d1c8e7c45116908d24
Formbook
8c414ec076a803e04e7c01d98c79516967eec77dc8cca0ddbe236cea79ddcff8
Formbook
bbfe5eaa0138f51710292488a384e4f6dcb65a6cba2a4c63387c714cec753d6e
Formbook
cbf41a6d78de6866a9f86a9d1b2b63720f4ea5f63c9be909764154e6bd674f66
Formbook
d8ae48ff83b31d072c1a9d988660e2a0be125aa9373a4adb1dd807d0fea4ebe5
Formbook
e56fe870da3015a5537b82acf5b9228953cafa74235b5c9257eaf049a6045cc6
Formbook
fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71
Formbook
+ 3'737 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210212-gmklk5n596/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.thefallofthedollar.com/ocq1/
Unpacked files
SH256 hash:
b2499a2af35b550fbe7f541a14ff1225e1202324f351eecf85de6c8e9fc7c27c
MD5 hash:
5e732e4265622675313195dead01047e
SHA1 hash:
359c710a93c2f58cdc2a45de8dd48a6884a70645
Link:
https://www.unpac.me/results/52655756-865e-4d24-bdff-26a68094fa93/
SH256 hash:
d68888aa1e155ac65bd1ddabcf05f61bfff65f79a11cc0ee099200c3da8c5d35
MD5 hash:
c04e9037beabc65baa9e3aa9bd693c1a
SHA1 hash:
372ec6b31bc9d7bde1545927807ad71326473162
Link:
https://www.unpac.me/results/52655756-865e-4d24-bdff-26a68094fa93/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/d68888aa1e155ac65bd1ddabcf05f61bfff65f79a11cc0ee099200c3da8c5d35

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

ace 5a8fde608d451346a043f140754483a81bfc522d70026be8c15b6114c5a09325

Formbook

Executable exe d68888aa1e155ac65bd1ddabcf05f61bfff65f79a11cc0ee099200c3da8c5d35

(this sample)

  
Dropped by
MD5 e8b9c26fb44b5180cd26df1488a1ed95
  
Dropped by
SHA256 5a8fde608d451346a043f140754483a81bfc522d70026be8c15b6114c5a09325
  
Dropped by
Formbook
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/116930/

Comments