MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5f5e88e8becfe092d10a927f72f580fd3a98612989a69a1f6df309f32b169f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5f5e88e8becfe092d10a927f72f580fd3a98612989a69a1f6df309f32b169f6
SHA3-384 hash: 5cd897ed70252620b29275e64c6c7c5905266d84b4479b260ee9832c1d4674601c86103c3f119cc6c4d707fc08c893e9
SHA1 hash: d06ac0fc49a473fafac1069ebe195edd6996cec1
MD5 hash: 15125bd7f04e0129ceebb7781f7051d2
humanhash: undress-eighteen-ceiling-nevada
File name:HSBCscancopy-invoice778483-payment87476MT103.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:719'872 bytes
First seen:2024-07-03 08:40:16 UTC
Last seen:2024-07-03 09:21:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fc6683d30d9f25244a50fd5357825e79 (92 x Formbook, 52 x AgentTesla, 23 x SnakeKeylogger)
ssdeep 12288:mYV6MorX7qzuC3QHO9FQVHPF51jgcmB+3sSfAW5p5c+EV6XpIzmb:lBXu9HGaVHm8SWHe+E8Emb
TLSH T10BE412526E03ED7EC4BF42F9543EB550B503ED28C95B1A5E32DBB94687B82A4E033790
TrID 31.3% (.EXE) UPX compressed Win32 Executable (27066/9/6)
30.7% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
12.1% (.EXE) Win64 Executable (generic) (10523/12/4)
7.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
5.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon a065646aeec646ec (21 x AgentTesla, 13 x Formbook, 5 x DarkCloud)
Reporter abuse_ch
Tags:exe FormBook HSBC

Intelligence

File Origin
# of uploads :
2
# of downloads :
377
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e5f5e88e8becfe092d10a927f72f580fd3a98612989a69a1f6df309f32b169f6.exe
Verdict:
No threats detected
Analysis date:
2024-07-03 08:52:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ea57383a-f38c-4003-9169-4988691c6ce0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.AutoIt.1410.2733.32217.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66850f42655cbfe6fd97fd97win10vpnfull_triage
Tags:
Execution Network Stealth Shellcodecrypter
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
AutoIt lolbin masquerade microsoft_visual_cc packed packed packed shell32 upx
Link:
https://www.filescan.io/uploads/66850eadef9fdf64aa71dc92/reports/585cc705-9045-46ec-946a-35145d0f6e84/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/e5f5e88e8becfe092d10a927f72f580fd3a98612989a69a1f6df309f32b169f6
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b57d2034-30e8-4f97-ab48-7f7a297bb648
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1466744
Signature
AI detected suspicious sample
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sigma detected: Rundll32 Execution Without CommandLine Parameters
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1466744 Sample: HSBCscancopy-invoice778483-... Startdate: 03/07/2024 Architecture: WINDOWS Score: 100 28 www.hawalaz.xyz 2->28 30 www.yetung.com 2->30 32 21 other IPs or domains 2->32 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus detection for URL or domain 2->44 46 Multi AV Scanner detection for submitted file 2->46 50 6 other signatures 2->50 10 HSBCscancopy-invoice778483-payment87476MT103.exe 4 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 28->48 process4 signatures5 62 Binary is likely a compiled AutoIt script file 10->62 64 Writes to foreign memory regions 10->64 66 Maps a DLL or memory area into another process 10->66 68 Switches to a custom stack to bypass stack traces 10->68 13 svchost.exe 10->13         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 16 UTbMqukHxZGmxEZNWddXnDURe.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 rundll32.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 2 other signatures 19->58 22 UTbMqukHxZGmxEZNWddXnDURe.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.hawalaz.xyz 162.0.213.72, 49720, 49721, 49722 ACPCA Canada 22->34 36 www.lavillitadepapa.com 74.208.46.171, 49756, 49757, 49758 ONEANDONE-ASBrauerstrasse48DE United States 22->36 38 9 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e5f5e88e8becfe092d10a927f72f580fd3a98612989a69a1f6df309f32b169f6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e5f5e88e8becfe092d10a927f72f580fd3a98612989a69a1f6df309f32b169f6/
Threat name:
Win32.Trojan.Strab
Create hunting rule
Status:
Malicious
First seen:
2024-07-03 05:17:00 UTC
File Type:
PE (Exe)
Extracted files:
24
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4x26rdul5t7asliqvet7ol2yb7j2tbqstcngtipw34yj6mvrnh3a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
n/a
Score:
  7/10
Tags:
upx
Link:
https://tria.ge/reports/240703-klfljsyfnq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/02251704-123a-4ece-8008-b94bb7e697a8
Unpacked files
SH256 hash:
c775f9ac5579ec48e3b913fbe5924ea722c493feffe291ca3a2f319880f0afad
MD5 hash:
02b4b1eaa523d4b3a0591e1f91cf4e59
SHA1 hash:
58b672f3421f2c8830f9b176655574f674d1160c
Detections:
win_formbook_g0
Create hunting rule
win_formbook_w0
Create hunting rule
Link:
https://www.unpac.me/results/a5efcad3-8980-4fb2-afde-73658f00c43f/
Parent samples :
e5f5e88e8becfe092d10a927f72f580fd3a98612989a69a1f6df309f32b169f6
c9404373dd77def5ee7e95a4d5edfcf7cb8aa80e5dcc675fc56b386fd04dbbb6
SH256 hash:
11a05eb55eb03b4707decc435f0376c132608172641d8b6c711ee8acc578ae9b
MD5 hash:
0b5918ee9c03fa46bee31a2ec7451ac4
SHA1 hash:
e6145daf638fa9f6570d8286ff6c8c1b4f83b1b5
Link:
https://www.unpac.me/results/a5efcad3-8980-4fb2-afde-73658f00c43f/
SH256 hash:
fe827969b4b0bc9f3d39289d49e018858de8eef3a4a6fe3b1fa85e1c754aee36
MD5 hash:
8d2e0ce50ab17e57853fa50b47b44953
SHA1 hash:
c6a6fe52ae56d608d02855c41d2cb1778a3e7548
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/a5efcad3-8980-4fb2-afde-73658f00c43f/
SH256 hash:
cf93d6e97f4e0ad30f470116913f5db85a99c46667f2611329452b80762e4e40
MD5 hash:
c680feeda0507c97f15d4f05d7b26b02
SHA1 hash:
f93898270115efc6e8eee090e5c1278b543bf92f
Link:
https://www.unpac.me/results/a5efcad3-8980-4fb2-afde-73658f00c43f/
SH256 hash:
c3f725217405da3bc88c7f616a447af521fc473c3cd782496f111e98923e234e
MD5 hash:
847e29ecb034196a500ba82339373faa
SHA1 hash:
debe579944d03d80db51bb889f9a79d41f1f8b68
Link:
https://www.unpac.me/results/a5efcad3-8980-4fb2-afde-73658f00c43f/
SH256 hash:
f8fae370711eb66dc4458a9290a044f69488471cf37d4220939d99b2721f3fd4
MD5 hash:
cebb697ca28fa54ea522c2be13ef5bc9
SHA1 hash:
b0e46c4872c2ac6e9caabeeb50a7a40237bad3e1
Link:
https://www.unpac.me/results/a5efcad3-8980-4fb2-afde-73658f00c43f/
SH256 hash:
adced8cdc5e2685f1c6074d73ff61a2fa8ada8a66432e9d5496f8ec530dc9cf5
MD5 hash:
691f58a0ba3b8729a78a4df091444ec9
SHA1 hash:
acc90112c36781334bb7cd137565ef67d3d0f9d6
Link:
https://www.unpac.me/results/a5efcad3-8980-4fb2-afde-73658f00c43f/
SH256 hash:
55120cdc19b2ca8d446c68f7169ec594c666cb38774769644b9bb9bbb113768a
MD5 hash:
820295495058246666f660c5d925764c
SHA1 hash:
aa1031f3742cc6de4d845159c650515bb510b0b5
Link:
https://www.unpac.me/results/a5efcad3-8980-4fb2-afde-73658f00c43f/
SH256 hash:
56452e3aa474bfeaf98eef88e4d940816256fb8a2ec29f3eab71a49644a63097
MD5 hash:
a4ee1b07ca6e5c25e1a5a7f5fe49c08b
SHA1 hash:
2c7a42bfaab9013547c86e9697a4d3ecfa3c74c3
Link:
https://www.unpac.me/results/a5efcad3-8980-4fb2-afde-73658f00c43f/
SH256 hash:
e5f5e88e8becfe092d10a927f72f580fd3a98612989a69a1f6df309f32b169f6
MD5 hash:
15125bd7f04e0129ceebb7781f7051d2
SHA1 hash:
d06ac0fc49a473fafac1069ebe195edd6996cec1
Detections:
SUSP_Imphash_Mar23_3
Create hunting rule
Link:
https://www.unpac.me/results/a5efcad3-8980-4fb2-afde-73658f00c43f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e5f5e88e8bec/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e5f5e88e8becfe092d10a927f72f580fd3a98612989a69a1f6df309f32b169f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:SUSP_Imphash_Mar23_3
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:Internal Research
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetAce
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetUseConnectionW

Comments