MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8d96fb0f87869e18b2f527be9a50e08768896ae6df8df2311a71bac4281a1e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8d96fb0f87869e18b2f527be9a50e08768896ae6df8df2311a71bac4281a1e2
SHA3-384 hash: 15ee5771e72fe592a85cacf396e7abaa15077f9bd1aa8c8b4a444d7cfe95c048f892411fbf4e6a5e77248868436cf008
SHA1 hash: 876db29c86c3e908cade429a3b23606a806191e4
MD5 hash: 4d325fde546f8f2dbbe521153653b793
humanhash: summer-sink-pip-maine
File name:4d325fde546f8f2dbbe521153653b793.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:600'576 bytes
First seen:2023-04-17 13:35:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:wYxbKn3LGFSRSN4rke3vqlTU7sJfJtvexAytKSJucJ:RxKKFSRpwlTk03eOeu4
Threatray 2'589 similar samples on MalwareBazaar
TLSH T1AED4F119D025AEF6E6CD0A3600043ADDEF6066E374B7C23C4BA674DADB9F7192D84487
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
229
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4d325fde546f8f2dbbe521153653b793.exe
Verdict:
No threats detected
Analysis date:
2023-04-17 13:38:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ecf8e9cf-b66a-4860-a78e-b17d7f206ee4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/382809/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/643d4b46000396b4e998fa61/reports/99616bb4-cd0a-44a3-bb02-a83aabf2a72a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/d8d96fb0f87869e18b2f527be9a50e08768896ae6df8df2311a71bac4281a1e2
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9c8686af-4ea9-445d-95ff-115ec30444f3
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1215238
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8d96fb0f87869e18b2f527be9a50e08768896ae6df8df2311a71bac4281a1e2/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-04-17 13:36:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3dmw7mhypbu6dczpkj56tjiobb3irfvonx4n6iyru4n2yqubuhra._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0bf1ad7e3d5f2bdd589d32f36db80fe2862a8b3412c7cfcdef4f839c9339d6af
Formbook
2209edf0bdf92002d675b50958adeffbffb6f8aabf27ca011e0528b453db566a
Formbook
42f025f744bb97509425ac749ada6c20ef6439d193e537a013b981ad4d21e124
Formbook
49daade32a02cad550a909add48d98aac63ac1cccf729758d7099975ad25ca82
Formbook
4a5ee921941ba55cd069a52fc95732b78f4c430a28236c3bd752ac350e4ffa79
Formbook
5267caaadc1e9d045e08de329de614b3b85f615aeec1a5927c32cfe82d493d2c
Formbook
5e86212f51e61517dde3cc7d0c36b73a392816d73e18bd14d83b374bcf17ecf5
Formbook
898d893d7c46d0c70d498f0323b24175c4d49df99b88f57d30aef08cb3e3edca
Formbook
f0ce6536bd8f80c0ee0ff1a246fd8447514906a38d4d24ec0d373c814180f9fb
Formbook
f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad
Formbook
+ 2'579 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230417-qv874sga5z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
c0c51c47ce7fa47270ca3f194f5ee5f0802af346709c5a8e27bb97d420d816d0
MD5 hash:
55a409361de81a1657e69c3130b50393
SHA1 hash:
3fb7b329c33801ab7f8c8e1f75ef660410115b98
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/45435c59-a33e-4f0c-afe3-49df5bcf0e31/
Parent samples :
ac490c07e24ae020a00defb4918034e4a0fe80389b001227f073dc6804fc76fe
d8d96fb0f87869e18b2f527be9a50e08768896ae6df8df2311a71bac4281a1e2
SH256 hash:
540859d84e47b1578f7cde10e9fbe13e4c1993065b8e23c242d3d36e67efe45a
MD5 hash:
b75d1b3049e8a95b5132144ecb05f66a
SHA1 hash:
f89c0b6cd32eaeb468e1f3422e576a2df6a124c5
Link:
https://www.unpac.me/results/45435c59-a33e-4f0c-afe3-49df5bcf0e31/
SH256 hash:
0fd1f00d94aff36ad8f02077efb33ddf269985ea37038aae554ff6202fdc020f
MD5 hash:
8dfd8e44c82066f4aeeff652fa2a33c5
SHA1 hash:
b844952e48ecab0e7ab2e3d5e38a20629399f94c
Link:
https://www.unpac.me/results/45435c59-a33e-4f0c-afe3-49df5bcf0e31/
SH256 hash:
9681c2e20edace6d145676f118375add810b10cc2708c2f6e87722c2933fe7d9
MD5 hash:
4c87638af425203c2623d4b8377bca63
SHA1 hash:
8d9be4d66080d06c1919f927f4950a95afb94e60
Link:
https://www.unpac.me/results/45435c59-a33e-4f0c-afe3-49df5bcf0e31/
SH256 hash:
ed3c0cfbeca9d3869ce9c29b1cf8f0bb711923b150715e0892d59dc289108c15
MD5 hash:
55b0877a312597e55678fc4bab78e7af
SHA1 hash:
304e41942ccfed9b7e271ecaf4006ab6891a50f3
Link:
https://www.unpac.me/results/45435c59-a33e-4f0c-afe3-49df5bcf0e31/
SH256 hash:
e5518e76f14e87bcc58a705c6f8f3a686cbffefc0e55985d17a067adfddf3688
MD5 hash:
920a2854e9c183ad2ef7d5543c296d38
SHA1 hash:
2c20da753bdf6f1a46261e2c132dd42f75c94229
Link:
https://www.unpac.me/results/45435c59-a33e-4f0c-afe3-49df5bcf0e31/
SH256 hash:
d8d96fb0f87869e18b2f527be9a50e08768896ae6df8df2311a71bac4281a1e2
MD5 hash:
4d325fde546f8f2dbbe521153653b793
SHA1 hash:
876db29c86c3e908cade429a3b23606a806191e4
Link:
https://www.unpac.me/results/45435c59-a33e-4f0c-afe3-49df5bcf0e31/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d8d96fb0f878/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d8d96fb0f87869e18b2f527be9a50e08768896ae6df8df2311a71bac4281a1e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe d8d96fb0f87869e18b2f527be9a50e08768896ae6df8df2311a71bac4281a1e2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2264749/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/382809/

Comments