MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 daf1d21f570270cea93b1f7238636e31aa2a5f328917e30b125f677c723bd46e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | daf1d21f570270cea93b1f7238636e31aa2a5f328917e30b125f677c723bd46e |
|---|---|
| SHA3-384 hash: | fb9f5b83fbd05112a78f5aec1feb83d919b182f3e7b533f375c197ed37c7bdaff2f3d8e563723b9fa4a0c8c906d83335 |
| SHA1 hash: | ca2792716d76aa9a54266a70fd480959e390631e |
| MD5 hash: | 1270eaf34998337f84bc57646c234a34 |
| humanhash: | august-xray-nine-orange |
| File name: | IMG_TH 500921847363.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 837'632 bytes |
| First seen: | 2022-07-20 09:42:35 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 24576:uD/Nl0d51ANuUwoqU9mldXAt2559qhYQIV:uJl0zqNuUwoqxw05Eht |
| TLSH | T16305010076BC1F92C97C93FD2469548123FA225B623DE7494ED3B5EF2A3AF114A64E07 |
| TrID | 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.5% (.SCR) Windows screen saver (13101/52/3) 9.2% (.EXE) Win64 Executable (generic) (10523/12/4) 5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.9% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  JAMESWT_WT |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
283
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
ID:
1
File name:
https://attach.mail.daum.net/bigfile/v1/urls/d/eWmPLZrPDRedUXegONAJ6JoGT3k/Hy-fGks8eTn4Mbxk9_4YWg
Verdict:
Malicious activity
Analysis date:
2022-07-20 09:28:51 UTC
Tags:
formbook trojan stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching the process to change network settings
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Detection:
formbook
Threat name:
Win32.Spyware.SnakeLogger
Status:
Malicious
First seen:
2022-07-20 07:45:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
21 of 26 (80.77%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
b3b480b10bad0389668b95d1889befa03167f9c1836a36267f5926b6d68e6481
MD5 hash:
8d0afd85a5c99b7c01804be85b975d93
SHA1 hash:
15c87fad61f8a67c93867ca7d44862bf11c93bbe
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
ca20b5fa883b968f75984600a7921775a88df15480f48bf204718b7f550e7b05
MD5 hash:
ec2970c9f9aff1ea704714a14e55f626
SHA1 hash:
ef3e35c1818bd85aa280327696af11c7a4b55fa1
SH256 hash:
39c2d879c57f07305ce60412dc8a88f02e51f1a14a06cc605768d1d7f5313807
MD5 hash:
db51fe170a9e5d6ec5429a2fbd9d0353
SHA1 hash:
e30a58125fc41322db6cf2ccb6a6d414ed379016
SH256 hash:
144c313707a06bce7afba9c73302ea771a4fc344b7d004395d1acdec9af1791c
MD5 hash:
53af1fe5362014452eecbf70719e61af
SHA1 hash:
7d77c71ee1b0799c0048f81313bdec070cf3d0e1
SH256 hash:
781c78f48dc35cb66432bd1826965cc59fb100d4d12c04432a2c92361f8364c3
MD5 hash:
4bfe50310c7b0dd87da13cc6109f0190
SHA1 hash:
2e3cfcf114927e004ea7788b29e5dc45c5f9e246
SH256 hash:
daf1d21f570270cea93b1f7238636e31aa2a5f328917e30b125f677c723bd46e
MD5 hash:
1270eaf34998337f84bc57646c234a34
SHA1 hash:
ca2792716d76aa9a54266a70fd480959e390631e
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.