MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcfd3789031450eb5a469d1bdcc81955975a7516c9e1d12acaeccd6c0c031b22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcfd3789031450eb5a469d1bdcc81955975a7516c9e1d12acaeccd6c0c031b22
SHA3-384 hash: de9c43c540078dd8c617947c0051891d069222f3c76ac331a2e54c182ff7c4d989d90ea7df5b350c11ec54e302124bfa
SHA1 hash: 8192195645e107c8993fce2efe85e32711336c23
MD5 hash: 1e6e57bb6983bad4dda8a7b475320c3d
humanhash: diet-seven-louisiana-pluto
File name:Nr 1177301317.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:216'576 bytes
First seen:2023-07-20 22:12:09 UTC
Last seen:2023-07-25 14:47:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:A4/E8dRhvlTrb+YIzQQ37ONOf1rio0MpYjfMi/s4gWTGWOcJD/Yih3rA:R/xlHarfSNOf1rH0MpYQHaTGyL90
Threatray 2'153 similar samples on MalwareBazaar
TLSH T1B02412016F8AF06CE135407914AF03CD426A77173E89562B636F6A97EDB813D12AE41F
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
310
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Virus trojan.trcrypt.zpack.gen FINAL RESULT for 18072023 .msg
Verdict:
Malicious activity
Analysis date:
2023-07-20 13:12:32 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/2baae1ba-dd6d-412d-859d-2dd8c7b6c4ff

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/427236/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/64b9b16f42d86ce7e10610c7/reports/a5aa8dac-e671-4951-a87f-19b264679b47/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/dcfd3789031450eb5a469d1bdcc81955975a7516c9e1d12acaeccd6c0c031b22
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/78c84fe0-9414-4808-b0a5-b7dbe24c4220
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1277102
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dcfd3789031450eb5a469d1bdcc81955975a7516c9e1d12acaeccd6c0c031b22/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-07-20 22:11:49 UTC
File Type:
PE (Exe)
AV detection:
20 of 25 (80.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3t6tpcidcriowwsgtun5zsazkwlvu5iwzhq5ckwk5tgwydaddmra._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
00223d395991519c2f3c162f8ca07a10bfc627ecc36a9d995d85fcf0e6f24f33
Formbook
0e32221577915aa8a0871d2e2f01cc558450d69a93b8276b46cd70a8fcf4d84a
Formbook
190ab20809cf0e5dee4860df81f3151e95b23f9840f02ab3e9ad2f7cc02f46d5
Formbook
19c456f77ef7a2c3d34f397ab4d435092281b157a76ab5e5002370a283e40e65
Formbook
221f3d1fe2ec39b9854c584a51fa3cd49f23995f8ae99c8c7d8e2efa85bb38b0
Formbook
53bb0f293733cadbf6b5704cd0359b61acaa6367eb49268905714492d35ddf81
Formbook
655e1f7802f469886876b59344e294c278b3573a84c278c4f888627ebb5f2619
Formbook
8bb4dbfeb12ea6c27f6a4bf9ba8188cc231208519e0d7c42bb48c1d75062c76d
Formbook
989f73c339df6cf640b06dedf92cec20ed8c715186d6839177d57c73f9491e32
Formbook
c433841d01e8b7901e45455592fd6db08dd48b4caf2682d3222078018475de60
Formbook
+ 2'143 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230720-14259sah58/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Checks computer location settings
Unpacked files
SH256 hash:
7212312720d134983aac25259f1ed6dd0f5a866a6901193054c467c4f6ee47d9
MD5 hash:
fb788c70ffbbeff6199d3a34fb45179c
SHA1 hash:
4147190b54b0c69c294dec6e146b59b833a311bb
Detections:
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/917ba585-5d45-4237-b6d7-1db3b74594a7/
SH256 hash:
dcfd3789031450eb5a469d1bdcc81955975a7516c9e1d12acaeccd6c0c031b22
MD5 hash:
1e6e57bb6983bad4dda8a7b475320c3d
SHA1 hash:
8192195645e107c8993fce2efe85e32711336c23
Link:
https://www.unpac.me/results/917ba585-5d45-4237-b6d7-1db3b74594a7/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dcfd37890314/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.74
Link:
https://yomi.yoroi.company/submissions/dcfd3789031450eb5a469d1bdcc81955975a7516c9e1d12acaeccd6c0c031b22

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/427236/

Comments