MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1638f39bfb4089fd651a9f543a33990fd19d48a0931911300d5ec9e091ba4e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e1638f39bfb4089fd651a9f543a33990fd19d48a0931911300d5ec9e091ba4e3
SHA3-384 hash: 48371ed0ea2781ee636e0ea1fdd27f9660d4c947a3d538d2b316ce2da20c77420445b52de98713daa6cfaae60bd0bb43
SHA1 hash: 00618f3bea5e4c40f691b404b9b5a9a43db0e980
MD5 hash: 6f7ef542d83ae3143fa8b4a52634820e
humanhash: oscar-montana-ack-west
File name:e1638f39bfb4089fd651a9f543a33990fd19d48a0931911300d5ec9e091ba4e3
Download: download sample
Signature Formbook
Create hunting rule
File size:192'512 bytes
First seen:2023-07-25 10:48:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:aRWJYiODh3VUY/PKJpFmDaD0Vdp8ImpBZ/IQf6Vgqc9HZnRhzOj6Bi6x/x6pqp+N:aRWWi9wKrMDaEdp8ZxIe65GHRjHAO/IP
Threatray 1'930 similar samples on MalwareBazaar
TLSH T18714238078C2F6FFC0B4A3FBD2AB71A08F52377B9E1994943AE6445155D40D8D220E3A
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
275
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e1638f39bfb4089fd651a9f543a33990fd19d48a0931911300d5ec9e091ba4e3
Verdict:
No threats detected
Analysis date:
2023-07-25 11:05:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4a397959-771d-46b7-8bec-ed0ea54621e0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/432131/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Gathering data
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/e1638f39bfb4089fd651a9f543a33990fd19d48a0931911300d5ec9e091ba4e3
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/78823b9a-f476-4378-aad3-8239aff6d906
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1279082
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e1638f39bfb4089fd651a9f543a33990fd19d48a0931911300d5ec9e091ba4e3/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-07-25 10:49:15 UTC
File Type:
PE (Exe)
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4fry6on7wqej7vsrvh2uhizzsd6rtvekbeyzceya2xwj4ci3utrq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
4c0306a3bc97e18ba8ed1b8a3de3d2430431aae2cb682daa173fcf3ebdc694f6
Formbook
4cd8d66fb0f643bf560702da7398ed5c27c1516ca15b7c9242f9583a162049a4
Formbook
56ad658ef29551d86add3dc7f16538402f1d894ec746bdf14444a4b01deabda4
Formbook
6170ca69b5a91bef9aa4313b172e1e1cad9a1fe2e4f049052315fba5f9fc29cc
Formbook
8c5c20763f5514325caf9fd4aa11531658fbf52200ba359f4aa3d4c7284c464d
Formbook
8e8dd0e9d0adac40a526531b51e77cd939d0d15f7d93fc6394d58d503b8ef8de
Formbook
ac0ae00f56127b9a2036156b7fb50c8eb65347d8773ca8a6e5ca0f92cc39ca59
Formbook
de30e038eaa635585c23ec16221f9307e49152fe0d42d6f49a9435beb42f1f9f
Formbook
fed0556f87884c7d40eadd3e2f22d432da0b5854edda4404a936f5b66e00b534
Formbook
+ 1'920 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230725-mwpcjscg7x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
c6e37332b2ffbb493cced3d95acfcdbefb0e94808f8335c4843d7f2f8bf72bbf
MD5 hash:
e197b7e231a7e1ddd0cb1afce8d10dad
SHA1 hash:
b5a1de18eb1515504a8cddca606f1a92400bf6eb
Detections:
XLoader
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/8c090ac2-d3c2-4576-9c61-7b3de75be54a/
SH256 hash:
e1638f39bfb4089fd651a9f543a33990fd19d48a0931911300d5ec9e091ba4e3
MD5 hash:
6f7ef542d83ae3143fa8b4a52634820e
SHA1 hash:
00618f3bea5e4c40f691b404b9b5a9a43db0e980
Link:
https://www.unpac.me/results/8c090ac2-d3c2-4576-9c61-7b3de75be54a/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e1638f39bfb4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/e1638f39bfb4089fd651a9f543a33990fd19d48a0931911300d5ec9e091ba4e3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe e1638f39bfb4089fd651a9f543a33990fd19d48a0931911300d5ec9e091ba4e3

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/432131/

Comments