MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df607dfa701d132a8679f0855bfdca430246d46285e36f46a965bb8a67f4d7b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df607dfa701d132a8679f0855bfdca430246d46285e36f46a965bb8a67f4d7b6
SHA3-384 hash: fec9093ae612786347f88a9307ea9c923064be7bff1f2a4deb3a977659962c983709d170c502c961c6a02e427a1a071e
SHA1 hash: a377db80170c61f16fe3eb1c9543e76b0b0b30a5
MD5 hash: aa84c94ebf26c05edd63b238289c077c
humanhash: juliet-orange-rugby-avocado
File name:DHL_46049595.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:705'024 bytes
First seen:2024-12-10 06:04:31 UTC
Last seen:2025-01-10 14:35:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fc6683d30d9f25244a50fd5357825e79 (92 x Formbook, 52 x AgentTesla, 23 x SnakeKeylogger)
ssdeep 12288:3quErHF6xC9D6DmR1J98w4oknqOOCyQfJjtNEYbE+ZwruQYFdfc3PW6YQK4q:url6kD68JmlotQflHrLZw3URcfpw
TLSH T1C5E423894AD5E822D7A597B0857A8C901A34B473CFC8A7AEC334E61FFC31303985A75D
TrID 31.3% (.EXE) UPX compressed Win32 Executable (27066/9/6)
30.7% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
12.1% (.EXE) Win64 Executable (generic) (10522/11/4)
7.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
5.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
File icon (PE):PE icon
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter abuse_ch
Tags:DHL exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
423
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL_46049595.exe
Verdict:
No threats detected
Analysis date:
2024-12-10 06:08:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/00b2392f-6a44-4a79-8ebc-a4acdafc6b31

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.1035.11335.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6757da1248182d16855763ab
Tags:
malware
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
autoit compiled-script extrac32 lolbin masquerade microsoft_visual_cc mmc packed packed packed packer_detected upx
Link:
https://www.filescan.io/uploads/6757da123aca1b2adf9d10a0/reports/3b995705-21e2-4dd8-9a81-12ebb92e0200/overview
Verdict:
Malicious
Labled as:
Trojan[Packed]/Autoit
Link:
https://www.hybrid-analysis.com/sample/df607dfa701d132a8679f0855bfdca430246d46285e36f46a965bb8a67f4d7b6
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6527b851-5afb-40ff-8b8a-24c4b2aaeb05
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1572141
Signature
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/df607dfa701d132a8679f0855bfdca430246d46285e36f46a965bb8a67f4d7b6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/df607dfa701d132a8679f0855bfdca430246d46285e36f46a965bb8a67f4d7b6/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2024-12-10 01:01:54 UTC
File Type:
PE (Exe)
Extracted files:
52
AV detection:
16 of 38 (42.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=35qh36tqdujsvbtz6ccvx7okimbenvdcqxrw6rvjmw5yuz7u263a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
unknown_loader_036
Create hunting rule
Similar samples:
error
Formbook
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery upx
Link:
https://tria.ge/reports/241210-gs7f3awje1/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Verdict:
Suspicious
Tags:
trojan
YARA:
SUSP_Imphash_Mar23_3
Link:
https://app.threat.zone/submission/b7d4ba4b-2750-454d-a1cf-38c8b49d91de
Unpacked files
SH256 hash:
c16a736911d0dc6c6d43680f5d771bdbee420f96eeb31f3302098d2d7fb1ea2d
MD5 hash:
6fe374eb8143a537c9be4297cc6a62b1
SHA1 hash:
b92e77e3cb8670b6e40843a6334efdb04d278b40
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/e4d818b9-d789-4f3c-9d0e-b10cccfba1e2/
Parent samples :
00c2d72b6a63a14fbe34e3fb19fad396213bb9be21ff695df527a676b866c8b2
9d7f2010937a9fa39e59ac0b46dfe1efe6dd5bb0748e1b4bf172e849ff916fb1
df607dfa701d132a8679f0855bfdca430246d46285e36f46a965bb8a67f4d7b6
91ae1faec9830fc63441d4a2819d460fee2bace496c5f11663e81aa88f922d2f
a139ad8f39832bc6f3a7cbb950b49a3a4cef52888099d7fc662c52e1d6b39862
d88cbfff7d6a8163e124249f07e2f8434d6e5474fcda9f916f89afe50b88f413
SH256 hash:
7bc501d93a5bcec412a171b83123c6a4b975c78f9ad6d8edbc78717876a0020b
MD5 hash:
9c9e65b1df682423a3166b07b3460871
SHA1 hash:
16e124998359172eac3216bd9f25dcde2de0d386
Link:
https://www.unpac.me/results/e4d818b9-d789-4f3c-9d0e-b10cccfba1e2/
SH256 hash:
2d2f55fd4f3153b7130e9cc90c45b89d2cfbdc5f5a64c337c550e38c592c5c27
MD5 hash:
85ee793a080ce9969230c116bb013092
SHA1 hash:
788c4516bf79ab7ae402b8f42848af371ce10476
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/e4d818b9-d789-4f3c-9d0e-b10cccfba1e2/
SH256 hash:
df607dfa701d132a8679f0855bfdca430246d46285e36f46a965bb8a67f4d7b6
MD5 hash:
aa84c94ebf26c05edd63b238289c077c
SHA1 hash:
a377db80170c61f16fe3eb1c9543e76b0b0b30a5
Link:
https://www.unpac.me/results/e4d818b9-d789-4f3c-9d0e-b10cccfba1e2/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/df607dfa701d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/df607dfa701d132a8679f0855bfdca430246d46285e36f46a965bb8a67f4d7b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_Imphash_Mar23_3
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:Internal Research
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetAce
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetUseConnectionW

Comments