MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e38d7e764bae9be6ef464c001dc3784c28d165bff06c390ef600d785ec1871c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e38d7e764bae9be6ef464c001dc3784c28d165bff06c390ef600d785ec1871c1
SHA3-384 hash: c549eac33ff2be667ea7f0bc0fbddb4e5c3f9b350c2e94ccdb7a2a03d5162bc406d83d5a7f48ed1705e79c4fd11d6769
SHA1 hash: ee87dc3bfaa01ac224ef89b57232c213c2307fb3
MD5 hash: 890d52fe0ec6061b68305942d668954f
humanhash: zebra-avocado-mexico-timing
File name:PO 234111039.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:803'840 bytes
First seen:2024-09-13 10:06:01 UTC
Last seen:2024-09-13 16:16:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fc6683d30d9f25244a50fd5357825e79 (92 x Formbook, 52 x AgentTesla, 23 x SnakeKeylogger)
ssdeep 24576:V4GHnhIzOaWuzN4s4qTuDJEMojgp9yjE:ishdabZyqQp
TLSH T1410523D4D4E2802AC4E52378C1754EF81EA5FC72A9CA369783E2E55AFC25707E513B0E
TrID 35.7% (.EXE) UPX compressed Win32 Executable (27066/9/6)
35.0% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
8.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter cocaman
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
4
# of downloads :
389
Origin country :
CH CH
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FileRepMalware.2832.17180.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66e40e9576bc4542b0499025
Tags:
Swotter
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit lolbin microsoft_visual_cc packed packed packed phishing shell32 upx
Link:
https://www.filescan.io/uploads/66e40e8fd37c5f9a19765e71/reports/529b84f5-3788-4a3e-82fb-c3adc1d0e93e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/e38d7e764bae9be6ef464c001dc3784c28d165bff06c390ef600d785ec1871c1
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d06cd726-65b8-4a1c-ac20-46d9f339013f
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1510739
Signature
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e38d7e764bae9be6ef464c001dc3784c28d165bff06c390ef600d785ec1871c1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e38d7e764bae9be6ef464c001dc3784c28d165bff06c390ef600d785ec1871c1/
Threat name:
Win32.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2024-09-13 04:41:23 UTC
File Type:
PE (Exe)
Extracted files:
51
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4ogx45slv2n6n32gjqab3q3yjqunczn76bwdsdxwadlyl3ayohaq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery upx
Link:
https://tria.ge/reports/240913-l43pgaxcnr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/71a9b5b2-0dfc-4b2f-8d5a-2925c281af0c
Unpacked files
SH256 hash:
a733c718bc86efb4dd0bc2f6003442637844451bbcf516ba0347300751ca672e
MD5 hash:
c7a95d6083a747e77534fe4d3a834e43
SHA1 hash:
ec7c51b46c3e2e3cfe8d5caaf5f5169c4cdca4a2
Detections:
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
Link:
https://www.unpac.me/results/77cefab2-bd2e-481d-85b1-b277e7ed9625/
Parent samples :
593d4af1922cf7edf2908ba830fc3ba4cdcf51fc0233fe72783cd836243fbecf
2b2814cc30915dd6022bf80353b6e37bdabd379c351fd2e201cd3ee53621b147
3666991ba9b1b0ab338f41c37c0bfe3a8ae0fbfbde9820679a76362a610a0b23
d662f78e5e0c62cdc866836476cc59a0f26edd95d9e14fd2f246792c39f44096
17a478564c4eb41b217ae131ab1b433278bb60bd0d4b0f876f602d71336abae3
3fe4c784dfb841053360622561788dacfc8e4b81567bc461e4cd33e61d2d1e64
e38d7e764bae9be6ef464c001dc3784c28d165bff06c390ef600d785ec1871c1
SH256 hash:
b56ca9d855c924787ee2fc975458503b38c2cdc2990386bc1aba61372ba4a5f0
MD5 hash:
70b61828deeb6bc00745fe9f4d283437
SHA1 hash:
f2fb66e2c0311841603dbf3220a11ea4b84a8ea1
Link:
https://www.unpac.me/results/77cefab2-bd2e-481d-85b1-b277e7ed9625/
SH256 hash:
a22aa889d918e4f7a4df852eabb0c8a19920078701779add7ad2ee9df75378a1
MD5 hash:
55098e62ab2c0cb66e023a640d568602
SHA1 hash:
3271a97d2d2350ab83a50a25011910f0327a3323
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/77cefab2-bd2e-481d-85b1-b277e7ed9625/
SH256 hash:
153b7b5359afab341459e76cf8006bee8265d0793a92097cfb2168a43f321e43
MD5 hash:
c14b7cf70c8eda50f3d715dee775d69d
SHA1 hash:
0a78c5152ffba77b7fdf2c4aeda8fd264e51d791
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/77cefab2-bd2e-481d-85b1-b277e7ed9625/
SH256 hash:
e38d7e764bae9be6ef464c001dc3784c28d165bff06c390ef600d785ec1871c1
MD5 hash:
890d52fe0ec6061b68305942d668954f
SHA1 hash:
ee87dc3bfaa01ac224ef89b57232c213c2307fb3
Detections:
SUSP_Imphash_Mar23_3
Create hunting rule
Link:
https://www.unpac.me/results/77cefab2-bd2e-481d-85b1-b277e7ed9625/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e38d7e764bae/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e38d7e764bae9be6ef464c001dc3784c28d165bff06c390ef600d785ec1871c1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_Imphash_Mar23_3
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:Internal Research
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar e0bb943ac9ad69af112371ec76461bae682a97b29e13df23541e48fcb1dc1629

Formbook

Executable exe e38d7e764bae9be6ef464c001dc3784c28d165bff06c390ef600d785ec1871c1

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 e0bb943ac9ad69af112371ec76461bae682a97b29e13df23541e48fcb1dc1629
  
Dropped by
SHA256 3b83704422078d3c197701185a0d531c66072f7400e85f57ee7033c29bb415dc
  
Dropped by
MD5 2baf37b4eab5dc58f016a5b848ce1076
  
Dropped by
MD5 a30107ad1d80ef46905e9522bdc907f5

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetAce
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetUseConnectionW

Comments