MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d96b4d0c1efd573f0833df766811861d8b116e92383da4543993971306ecbe4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d96b4d0c1efd573f0833df766811861d8b116e92383da4543993971306ecbe4d
SHA3-384 hash: 8615ace2688d6fbda5f4b345a4a7d6248ced97cbccdc94a57ab6af3c8f15614121bfd0cbd3738d250bec89ff5118dbda
SHA1 hash: fa0287d06f4bdee5df266f886df104f510b830be
MD5 hash: ff0d3a62fd13c959bcc2262818cb5672
humanhash: leopard-kentucky-moon-earth
File name:revised order.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:764'416 bytes
First seen:2023-05-23 07:11:46 UTC
Last seen:2023-05-24 11:48:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'598 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:7DX91HFfl6G0sQ5quLOLafi2Hmglqm1lXr881V5O+EARAs+:7R1HFfl6G0selLOefVmgqmrgAVnA5
Threatray 2'959 similar samples on MalwareBazaar
TLSH T11BF49D9533B5DF2AD87D83FF06F0A08D0FB875067026E2195F9735D23270B666A48A93
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
4
# of downloads :
258
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
revised order.exe
Verdict:
No threats detected
Analysis date:
2023-05-23 07:12:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bba7af8c-9d52-49a6-a18c-4dc7670ca176

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.6956.13322.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Launching a process
Creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin packed
Link:
https://www.filescan.io/uploads/646c6745c6dde73a25391c1b/reports/8acbb23e-b884-43f5-8868-9f94c4f75abe/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/d96b4d0c1efd573f0833df766811861d8b116e92383da4543993971306ecbe4d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/956109a4-6836-4410-8a2f-d9037d727259
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1240591
Signature
.NET source code contains potential unpacker
Initial sample is a PE file and has a suspicious name
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 873596 Sample: revised_order.exe Startdate: 23/05/2023 Architecture: WINDOWS Score: 72 15 Malicious sample detected (through community Yara rule) 2->15 17 Multi AV Scanner detection for submitted file 2->17 19 Yara detected FormBook 2->19 21 2 other signatures 2->21 6 revised_order.exe 3 2->6         started        process3 file4 13 C:\Users\user\...\revised_order.exe.log, ASCII 6->13 dropped 9 RegSvcs.exe 6->9         started        11 RegSvcs.exe 6->11         started        process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d96b4d0c1efd573f0833df766811861d8b116e92383da4543993971306ecbe4d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-22 15:11:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
19 of 35 (54.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3fvu2da67vlt6cbt353gqemgdwfrc3usha62ivbzsolrgbxmxzgq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0480f30f1070d12b3231c495ee15699f09049f1c5bc19e889ebd2f3571bd4ab7
Formbook
09c909d826f67375085a88c5a85bd863d6df12765f7584ed2d439af77afc4c21
Formbook
1950034453da28649135d35016d5ab7ee791cd4bbbc1e4a72f7c56ce3aa9dd9a
Formbook
291f9c211eed167fbf4b31411d79c7447a09b29dd2308dceacacc3fe31fa2364
Formbook
47c74b216015a03abc6bf2a786c4c760fe23f5ce920c9a0ed6e68aa340568e84
Formbook
6ea7ca3a65d2621c8a9c7502eb9a7f914d5a155a3791e551cc3308f638ea307c
Formbook
89dc8c98551c4f2b309fd2807b8bf1d24e1c2abd953930f95b5aa1987e0966f2
Formbook
a1a882d7abefdec8678649330339a2f080a777450da1be5110b88e81a8ea38cc
Formbook
f071e06b294ad94e6c83f6b35a9700b8cb3df225e76096730a38567de1c50450
Formbook
fcabc2e435d451a512f1fdd1b9425ddc3d336812d4b33d1ccaaab42e8e752fc2
Formbook
+ 2'949 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230523-h1hncafb2t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
70382ea1b363da419e2b0e806739138db40b4ec2ea276de2f1aefbd46ee66ac9
MD5 hash:
c260a705d14d1209ee29f226099010a1
SHA1 hash:
f7a97ae4da5562d1064bc7c94d7b68e184361bcf
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/9a0ae4ef-bba5-48d2-a79b-39f03f1ab213/
Parent samples :
d96b4d0c1efd573f0833df766811861d8b116e92383da4543993971306ecbe4d
70d226c93cae74dfc4fc991b3fc74957cfb08881f53c232ed87e0d22cc5e30f1
76541f045182cd4f956ea38e70aac522dd8cc95bec94eb16ff435ac732da3b97
22515e24bf09d7d7b9ed02436f05853d5174aac248eb79c2b32a82096c8b30a3
2df55ec2cbfe5ba2ddfd9a597a1c2dcfe3c91f211ba611180c97443773f79732
34a8585e0643993caaaa6c3fcd9933354087422062d3c887dada1d65b570bfb3
a022bc0ad88cce0b7ef8c68c7602003ff4150006503291b7ead2119ebdecb36d
03f51ffa9c987630724a451ad872f52bf97bd257ad06b58b6194f5dec29c8f13
395133081793df5c1542b9e77a64a5271d1b358c1a7db674108a7624a9104809
af7efb93740b9b9ee4cd6580a3eefa8298558c9f06b463eb44b03394cde441d5
0335bef9440cae7dd60e617e31258a490b9598e3dfa1325bf79ca9eca5c4c720
4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d
02dc237cae6224ab8277187f6574215e15b4ddd4bf5b2bddbedaa95fc077e4e2
14bd08ddfd5f3fbeffbe9adacf4662f83267492eb8a2ca70a5c7613050039dc9
3c4e179c3ad40c3916a358a7115d8b4ad6d957cb57cecbba7c979057e5370748
16ef953132f6f51c904ccd3e04c933c20110c1dcbab443059df7218392291d5f
2ea5fd6b8b0354c95a41470ae8cb816d0ffb61b6b34cd827ffa160c963b850ed
0978bd6c3a575dd054cd139eaecc851695800c859e61ed340b47c9d5bf0d0d38
ce9a0c42305d137c27b4f369996a15387ae6f0d1e391116f54e7733918083239
SH256 hash:
69ae0d2e1c3e2bbbe5183e41b3ac08a711b71c2740e59fab69abc6b463b249ae
MD5 hash:
4fc5c70a26e153516338b2bd4a6df5fb
SHA1 hash:
6d7e91edb55a50e3aeacf06752101ae672badc50
Link:
https://www.unpac.me/results/9a0ae4ef-bba5-48d2-a79b-39f03f1ab213/
SH256 hash:
1ef131d5b262f0b7fd6ac0795cf86ce86c13e3cba3f39c6eaeb8da4b01e46253
MD5 hash:
0a1d587b196db7b05f10583883975578
SHA1 hash:
ff536aea2f74a8e516b54725a2f08114c5fc6afb
Link:
https://www.unpac.me/results/9a0ae4ef-bba5-48d2-a79b-39f03f1ab213/
SH256 hash:
562e0920935173cccf012402e371c9a69a1cd93eb525a40ee8a3faf5c0524f1a
MD5 hash:
06dc9be9cca0efb70fdf925080ce71e3
SHA1 hash:
f1864171bf2b6b4f349610d06c0e6346dfdc7356
Link:
https://www.unpac.me/results/9a0ae4ef-bba5-48d2-a79b-39f03f1ab213/
SH256 hash:
4c7ce432433fc3a8b0a33d558e0041d3f1c222224c5e61f33104d990a534c7a4
MD5 hash:
e8d756b4e2de5a67446e0b1b80e1bb99
SHA1 hash:
b664448f87ac044a16706d35e5d76538ba79508a
Link:
https://www.unpac.me/results/9a0ae4ef-bba5-48d2-a79b-39f03f1ab213/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/9a0ae4ef-bba5-48d2-a79b-39f03f1ab213/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
d96b4d0c1efd573f0833df766811861d8b116e92383da4543993971306ecbe4d
MD5 hash:
ff0d3a62fd13c959bcc2262818cb5672
SHA1 hash:
fa0287d06f4bdee5df266f886df104f510b830be
Link:
https://www.unpac.me/results/9a0ae4ef-bba5-48d2-a79b-39f03f1ab213/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d96b4d0c1efd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/d96b4d0c1efd573f0833df766811861d8b116e92383da4543993971306ecbe4d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe d96b4d0c1efd573f0833df766811861d8b116e92383da4543993971306ecbe4d

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments