MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e58e843ff95f4ca52f2e4da56fdb3edb62fe89415d53b30c0b187f12e9e644aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments

SHA256 hash:	e58e843ff95f4ca52f2e4da56fdb3edb62fe89415d53b30c0b187f12e9e644aa
SHA3-384 hash:	accef08254d5776ba417ececa7681d9626ff7d81f63da712a13f7b48238db1ae626c398a5f49b5c314e65ac5ae88e64e
SHA1 hash:	df3e75e53f11e03b2940098199af9635f3fdb793
MD5 hash:	fc2b9bdbeaf228b78b65fecceba09b0d
humanhash:	november-red-uncle-november
File name:	SOA_CU61909016023 pdf.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	889'344 bytes
First seen:	2023-07-04 12:55:20 UTC
Last seen:	2023-07-04 13:31:35 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:TmDhy1RHR6XvKlV+u/+HRtF55/2JUWqTFigGcbiTmhHH:Nk/k+vJ/2leFigphHH
Threatray	3'225 similar samples on MalwareBazaar
TLSH	T1FA157E3829BC5F26C135C7F54F94C120F26499EB3166CF266BC2AAD6161DB0229C7D3E
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	70c0d0f0c8c4f0f0 (5 x Formbook)
Reporter	cocaman
Tags:	exe FormBook onedrive

Intelligence

File Origin

# of uploads :

# of downloads :

304

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SOA_CU61909016023 pdf.exe

Verdict:

Malicious activity

Analysis date:

2023-07-04 12:57:42 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/efcb9e1f-cddb-4f65-857d-ea0c1420ee2a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/406652/

Detection(s):

SecuriteInfo.com.Trojan.Siggen21.4532.28002.16268.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Restart of the analyzed sample

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

barys comodo lokibot packed

Link:

https://www.filescan.io/uploads/64a416e43d1253262b2d5702/reports/a7398101-95f9-4ccf-b483-991be2f3d8fa/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/e58e843ff95f4ca52f2e4da56fdb3edb62fe89415d53b30c0b187f12e9e644aa

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7d93bcf6-88c3-4b5d-8155-db82f55dd3fe

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1266602

Signature

.NET source code contains very large strings

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e58e843ff95f4ca52f2e4da56fdb3edb62fe89415d53b30c0b187f12e9e644aa/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-07-04 12:55:24 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4whiip7zl5gkklzojwsw7wz63nrp5ckblvj3gdaldb7rf2pgisva._file

Verdict:

malicious

Label(s):

formbook

Formbook

02bc9f274f7ba4ec93358bfa71c5b658727b414e7e6301c50fac619227a78327

Formbook

2692c5fb278a85db144c8121617ab7909a54281e5161b8bff920bd485ea4eccf

Formbook

2ea5fd6b8b0354c95a41470ae8cb816d0ffb61b6b34cd827ffa160c963b850ed

Formbook

34a8585e0643993caaaa6c3fcd9933354087422062d3c887dada1d65b570bfb3

Formbook

571f10fb2f8ed39463e85d4a5af98f8203489b60d7a634d890462f10d6b15f2d

Formbook

642b58aecd23773984d262d3ec75346a5ed4f5409ef9aaa5babc4dcd0619b427

Formbook

92260cefa8e973f4c40e32aa5656cc9794b745db70b5c7b410a7b0b10c443c6c

Formbook

ce3a332225a10d659e26a1775a2e002ce62d470c9f02c47bbbf69767c7e2ffa9

Formbook

fd775a8681200c469cfdbda94d5c9cde3454cb21a4a4783bad3aa647cab4378e

Formbook

+ 3'215 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/230704-p6cgvadb47/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Checks computer location settings

Unpacked files

SH256 hash:

f47696d3fe493051030058a025fd47c77dbda5e4b943b375fdf5b76950106f90

MD5 hash:

228d9faa156b57dbe4c7482b370f76dc

SHA1 hash:

4a9c4882b4300066183cb68e6d04f3a0bc4ac548

Detections:

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

Parent samples :

e58e843ff95f4ca52f2e4da56fdb3edb62fe89415d53b30c0b187f12e9e644aa
6948e70cac42443ee400a93e1aa7dbcc742e36eeed2e7caf2ee5ff3e19bd9ef3

SH256 hash:

a533219477b64a5b643dcc3b8a232ba8a17863d7a1ab9d6c27bf3c36c00323fa

MD5 hash:

65be5adef8986f601c4d2859339bffaf

SHA1 hash:

cbce6c739352f00e7915ebd4c9d56d4464fc79c5

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

509ba3bef67abb0040410983ca74f0c045e91c43118c850147aa5e4a4045b5df

MD5 hash:

7363594ec73f29ae14ecc32a8756e1f5

SHA1 hash:

e0dc27a7b20506bb3931f7deaaf7043b053b3320

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5

MD5 hash:

adac60763fcfe4d5f4ad323046e79500

SHA1 hash:

9ced772a90ddec9fffde8c745225ad289f3f087e

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

973512f00ba81a790d2351f286c79dfea92692c9f7cd724e22ab11ff282f8130

MD5 hash:

3794c5f7b240e4184d6ea90c5bdd9ec6

SHA1 hash:

26b9c4a753779b4994fe38c16dfe70b07efd3e0d

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

f47696d3fe493051030058a025fd47c77dbda5e4b943b375fdf5b76950106f90

MD5 hash:

228d9faa156b57dbe4c7482b370f76dc

SHA1 hash:

4a9c4882b4300066183cb68e6d04f3a0bc4ac548

Detections:

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

Parent samples :

e58e843ff95f4ca52f2e4da56fdb3edb62fe89415d53b30c0b187f12e9e644aa
6948e70cac42443ee400a93e1aa7dbcc742e36eeed2e7caf2ee5ff3e19bd9ef3

SH256 hash:

f47696d3fe493051030058a025fd47c77dbda5e4b943b375fdf5b76950106f90

MD5 hash:

228d9faa156b57dbe4c7482b370f76dc

SHA1 hash:

4a9c4882b4300066183cb68e6d04f3a0bc4ac548

Detections:

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

Parent samples :

e58e843ff95f4ca52f2e4da56fdb3edb62fe89415d53b30c0b187f12e9e644aa
6948e70cac42443ee400a93e1aa7dbcc742e36eeed2e7caf2ee5ff3e19bd9ef3

SH256 hash:

a533219477b64a5b643dcc3b8a232ba8a17863d7a1ab9d6c27bf3c36c00323fa

MD5 hash:

65be5adef8986f601c4d2859339bffaf

SHA1 hash:

cbce6c739352f00e7915ebd4c9d56d4464fc79c5

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

a533219477b64a5b643dcc3b8a232ba8a17863d7a1ab9d6c27bf3c36c00323fa

MD5 hash:

65be5adef8986f601c4d2859339bffaf

SHA1 hash:

cbce6c739352f00e7915ebd4c9d56d4464fc79c5

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

509ba3bef67abb0040410983ca74f0c045e91c43118c850147aa5e4a4045b5df

MD5 hash:

7363594ec73f29ae14ecc32a8756e1f5

SHA1 hash:

e0dc27a7b20506bb3931f7deaaf7043b053b3320

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

509ba3bef67abb0040410983ca74f0c045e91c43118c850147aa5e4a4045b5df

MD5 hash:

7363594ec73f29ae14ecc32a8756e1f5

SHA1 hash:

e0dc27a7b20506bb3931f7deaaf7043b053b3320

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5

MD5 hash:

adac60763fcfe4d5f4ad323046e79500

SHA1 hash:

9ced772a90ddec9fffde8c745225ad289f3f087e

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5

MD5 hash:

adac60763fcfe4d5f4ad323046e79500

SHA1 hash:

9ced772a90ddec9fffde8c745225ad289f3f087e

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

973512f00ba81a790d2351f286c79dfea92692c9f7cd724e22ab11ff282f8130

MD5 hash:

3794c5f7b240e4184d6ea90c5bdd9ec6

SHA1 hash:

26b9c4a753779b4994fe38c16dfe70b07efd3e0d

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

973512f00ba81a790d2351f286c79dfea92692c9f7cd724e22ab11ff282f8130

MD5 hash:

3794c5f7b240e4184d6ea90c5bdd9ec6

SHA1 hash:

26b9c4a753779b4994fe38c16dfe70b07efd3e0d

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

f47696d3fe493051030058a025fd47c77dbda5e4b943b375fdf5b76950106f90

MD5 hash:

228d9faa156b57dbe4c7482b370f76dc

SHA1 hash:

4a9c4882b4300066183cb68e6d04f3a0bc4ac548

Detections:

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

Parent samples :

e58e843ff95f4ca52f2e4da56fdb3edb62fe89415d53b30c0b187f12e9e644aa
6948e70cac42443ee400a93e1aa7dbcc742e36eeed2e7caf2ee5ff3e19bd9ef3

SH256 hash:

a533219477b64a5b643dcc3b8a232ba8a17863d7a1ab9d6c27bf3c36c00323fa

MD5 hash:

65be5adef8986f601c4d2859339bffaf

SHA1 hash:

cbce6c739352f00e7915ebd4c9d56d4464fc79c5

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

509ba3bef67abb0040410983ca74f0c045e91c43118c850147aa5e4a4045b5df

MD5 hash:

7363594ec73f29ae14ecc32a8756e1f5

SHA1 hash:

e0dc27a7b20506bb3931f7deaaf7043b053b3320

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5

MD5 hash:

adac60763fcfe4d5f4ad323046e79500

SHA1 hash:

9ced772a90ddec9fffde8c745225ad289f3f087e

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

f47696d3fe493051030058a025fd47c77dbda5e4b943b375fdf5b76950106f90

MD5 hash:

228d9faa156b57dbe4c7482b370f76dc

SHA1 hash:

4a9c4882b4300066183cb68e6d04f3a0bc4ac548

Detections:

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

win_formbook_w0

win_formbook_auto

win_formbook_g0

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

Parent samples :

e58e843ff95f4ca52f2e4da56fdb3edb62fe89415d53b30c0b187f12e9e644aa
6948e70cac42443ee400a93e1aa7dbcc742e36eeed2e7caf2ee5ff3e19bd9ef3

SH256 hash:

973512f00ba81a790d2351f286c79dfea92692c9f7cd724e22ab11ff282f8130

MD5 hash:

3794c5f7b240e4184d6ea90c5bdd9ec6

SHA1 hash:

26b9c4a753779b4994fe38c16dfe70b07efd3e0d

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

a533219477b64a5b643dcc3b8a232ba8a17863d7a1ab9d6c27bf3c36c00323fa

MD5 hash:

65be5adef8986f601c4d2859339bffaf

SHA1 hash:

cbce6c739352f00e7915ebd4c9d56d4464fc79c5

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

509ba3bef67abb0040410983ca74f0c045e91c43118c850147aa5e4a4045b5df

MD5 hash:

7363594ec73f29ae14ecc32a8756e1f5

SHA1 hash:

e0dc27a7b20506bb3931f7deaaf7043b053b3320

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5

MD5 hash:

adac60763fcfe4d5f4ad323046e79500

SHA1 hash:

9ced772a90ddec9fffde8c745225ad289f3f087e

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

973512f00ba81a790d2351f286c79dfea92692c9f7cd724e22ab11ff282f8130

MD5 hash:

3794c5f7b240e4184d6ea90c5bdd9ec6

SHA1 hash:

26b9c4a753779b4994fe38c16dfe70b07efd3e0d

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

SH256 hash:

e58e843ff95f4ca52f2e4da56fdb3edb62fe89415d53b30c0b187f12e9e644aa

MD5 hash:

fc2b9bdbeaf228b78b65fecceba09b0d

SHA1 hash:

df3e75e53f11e03b2940098199af9635f3fdb793

Link:

https://www.unpac.me/results/692358f3-0636-46e1-a3f2-3e6f4c66e58c/

Malware family:

XLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e58e843ff95f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.