MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 de30e038eaa635585c23ec16221f9307e49152fe0d42d6f49a9435beb42f1f9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 15
| SHA256 hash: | de30e038eaa635585c23ec16221f9307e49152fe0d42d6f49a9435beb42f1f9f |
|---|---|
| SHA3-384 hash: | 82e100c0d0a3583bf22771b6e294d17bb159b6ead60ef81bc24c0d2d5fec1fc334d5d3a24d3350e320c8a41c781b5983 |
| SHA1 hash: | cd2c1ce82af072c52f2248d8cad9be3793b8d5ff |
| MD5 hash: | 700c7773b9c6e9b3a3440b2dd9370f2c |
| humanhash: | blossom-connecticut-purple-north |
| File name: | DHL Shipping Docs00945_pdf.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 277'447 bytes |
| First seen: | 2023-07-10 12:15:58 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| ssdeep | 6144:zvTeNBlexoP39vogFrJexGfb2uPWbqmBV+UdvrEFp7hKuNg:zre7lexI9vogFNAGKuyBjvrEH7BNg |
| Threatray | 3'293 similar samples on MalwareBazaar |
| TLSH | T1164412646345A3FEC0A8047071AE7E2458E2A93E07FF52DAC3271C8CDD6C9179AC561F |
| Reporter |  abuse_ch |
| Tags: | DHL exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
280
Origin country :
NLVendor Threat Intelligence
Malware family:
floxif
ID:
1
File name:
DHL Shipping Docs00945_pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-07-10 12:32:14 UTC
Tags:
floxif trojan
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Searching for the window
Creating a file
Creating a file in the Program Files subdirectories
Replacing executable files
Creating a file in the mass storage device
Infecting executable files
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
floxif formbook masquerade obfuscated overlay packed virus
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FloodFix
Detection:
malicious
Classification:
troj
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Threat name:
Win32.Virus.Floxif
Status:
Malicious
First seen:
2023-07-06 11:33:16 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
36 of 38 (94.74%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 3'283 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
upx
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Uses Task Scheduler COM API
Drops file in Program Files directory
Drops file in System32 directory
Enumerates connected drives
ACProtect 1.3x - 1.4x DLL software
Checks computer location settings
Loads dropped DLL
UPX packed file
Unpacked files
SH256 hash:
114e94baf1fb0fe70d69188a5dd23b675139bad7d547c0322b5346c0073008bc
MD5 hash:
f5bdcd5346d1157a8e48129946cb605b
SHA1 hash:
034d1271f807517599f42f71340d25d5c3e96eaa
Detections:
win_floxif_auto
win_floxif_auto
win_floxif_auto
SH256 hash:
bf7015462eca2a7b049085ef5879dbabc8ca1eba65e7b84379fb57e392f28f65
MD5 hash:
8fd7848b51ea13322302f7683ab622e3
SHA1 hash:
fe667643d8cf57c228c3eb35a65d5c5c0ad236f8
SH256 hash:
3447d8bafb5e0b8a0448266b4f1be77a3fb71e47353301eb92579b5c34433f64
MD5 hash:
267c67a9a194e0bb3ee26c20f87cc7db
SHA1 hash:
cc811c4f32b96ab1fb91815c257b8f304813a813
Detections:
XLoader
win_formbook_w0
win_formbook_auto
win_formbook_g0
XLoader
win_formbook_w0
win_formbook_auto
win_formbook_g0
XLoader
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
114e94baf1fb0fe70d69188a5dd23b675139bad7d547c0322b5346c0073008bc
MD5 hash:
f5bdcd5346d1157a8e48129946cb605b
SHA1 hash:
034d1271f807517599f42f71340d25d5c3e96eaa
Detections:
win_floxif_auto
win_floxif_auto
win_floxif_auto
SH256 hash:
bf7015462eca2a7b049085ef5879dbabc8ca1eba65e7b84379fb57e392f28f65
MD5 hash:
8fd7848b51ea13322302f7683ab622e3
SHA1 hash:
fe667643d8cf57c228c3eb35a65d5c5c0ad236f8
SH256 hash:
3447d8bafb5e0b8a0448266b4f1be77a3fb71e47353301eb92579b5c34433f64
MD5 hash:
267c67a9a194e0bb3ee26c20f87cc7db
SHA1 hash:
cc811c4f32b96ab1fb91815c257b8f304813a813
Detections:
XLoader
win_formbook_w0
win_formbook_auto
win_formbook_g0
XLoader
win_formbook_w0
win_formbook_auto
win_formbook_g0
XLoader
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
114e94baf1fb0fe70d69188a5dd23b675139bad7d547c0322b5346c0073008bc
MD5 hash:
f5bdcd5346d1157a8e48129946cb605b
SHA1 hash:
034d1271f807517599f42f71340d25d5c3e96eaa
Detections:
win_floxif_auto
win_floxif_auto
win_floxif_auto
SH256 hash:
bf7015462eca2a7b049085ef5879dbabc8ca1eba65e7b84379fb57e392f28f65
MD5 hash:
8fd7848b51ea13322302f7683ab622e3
SHA1 hash:
fe667643d8cf57c228c3eb35a65d5c5c0ad236f8
SH256 hash:
3447d8bafb5e0b8a0448266b4f1be77a3fb71e47353301eb92579b5c34433f64
MD5 hash:
267c67a9a194e0bb3ee26c20f87cc7db
SHA1 hash:
cc811c4f32b96ab1fb91815c257b8f304813a813
Detections:
XLoader
win_formbook_w0
win_formbook_auto
win_formbook_g0
XLoader
win_formbook_w0
win_formbook_auto
win_formbook_g0
XLoader
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
de30e038eaa635585c23ec16221f9307e49152fe0d42d6f49a9435beb42f1f9f
MD5 hash:
700c7773b9c6e9b3a3440b2dd9370f2c
SHA1 hash:
cd2c1ce82af072c52f2248d8cad9be3793b8d5ff
Malware family:
Floxif
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Malware_Floxif_mpsvc_dll |
|---|---|
| Author: | Florian Roth (Nextron Systems) |
| Description: | Malware - Floxif |
| Reference: | Internal Research |
| Rule name: | Malware_Floxif_mpsvc_dll_RID30C4 |
|---|---|
| Author: | Florian Roth |
| Description: | Malware - Floxif |
| Reference: | Internal Research |
| Rule name: | MALWARE_Win_FloodFix |
|---|---|
| Author: | ditekSHen |
| Description: | Detects FloodFix |
| Rule name: | MAL_Floxif_Generic |
|---|---|
| Author: | Florian Roth (Nextron Systems) |
| Description: | Detects Floxif Malware |
| Reference: | Internal Research |
| Rule name: | MAL_Floxif_Generic_RID2DCE |
|---|---|
| Author: | Florian Roth |
| Description: | Detects Floxif Malware |
| Reference: | Internal Research |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | SUSP_Microsoft_Copyright_String_Anomaly_2 |
|---|---|
| Author: | Florian Roth (Nextron Systems) |
| Description: | Detects Floxif Malware |
| Reference: | Internal Research |
| Rule name: | SUSP_Microsoft_Copyright_String_Anomaly_2_RID3720 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects Floxif Malware |
| Reference: | Internal Research |
| Rule name: | win_floxif_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.floxif. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.