MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e82d49a7282dbb896c9e5d2286f2c5575f36d5330d27a942532e19c01938d1b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 15
| SHA256 hash: | e82d49a7282dbb896c9e5d2286f2c5575f36d5330d27a942532e19c01938d1b9 |
|---|---|
| SHA3-384 hash: | e6924f097290354fc980e25965d0479336dd0037fdd2a2455310a22f2423a921add0e82322224a5d27e7c75c641149a3 |
| SHA1 hash: | 0fb5bf75128f3958f6136fb080f52a5b4d4b7d61 |
| MD5 hash: | 1bd37091a9130ee6baeabade878c19a0 |
| humanhash: | burger-johnny-foxtrot-victor |
| File name: | Packing List.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 741'888 bytes |
| First seen: | 2024-12-09 07:29:33 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | fc6683d30d9f25244a50fd5357825e79 (92 x Formbook, 52 x AgentTesla, 23 x SnakeKeylogger) |
| ssdeep | 12288:WquErHF6xC9D6DmR1J98w4oknqOOCyQfNVpEpRmSoYVPzbhMclhnrpS9vLBd80Q:brl6kD68JmlotQfTp8RmNY1BMOhnEhVW |
| TLSH | T103F4238909C6DC75D55972708439DC685B7478329E88BB5EC368E21FFC32303E86BB69 |
| TrID | 35.7% (.EXE) UPX compressed Win32 Executable (27066/9/6) 35.0% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 8.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.9% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| File icon (PE): |  |
| dhash icon | aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla) |
| Reporter |  adrian__luca |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
364
Origin country :
HUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Packing List.exe
Verdict:
Malicious activity
Analysis date:
2024-12-09 07:46:49 UTC
Tags:
upx autoit
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.1%
Tags:
autoit virus
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
anti-vm anti-vm autoit compiled-script evasive extrac32 lolbin microsoft_visual_cc packed packed packed packer_detected powershell upx
Verdict:
Malicious
Labled as:
Trojan.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
evad.troj
Score:
76 / 100
Signature
AI detected suspicious sample
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.AutoitInject
Status:
Malicious
First seen:
2024-12-05 03:29:59 UTC
File Type:
PE (Exe)
Extracted files:
51
AV detection:
30 of 38 (78.95%)
Threat level:
5/5
Detection(s):
Malicious file
Result
Malware family:
n/a
Score:
5/10
Tags:
discovery upx
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Verdict:
Suspicious
Tags:
trojan
YARA:
SUSP_Imphash_Mar23_3
Unpacked files
SH256 hash:
64045f1399264db680aebc38aa70205ebb68d620cfbe6c978348ec851278957b
MD5 hash:
d77626213fa962462cdac15ab4b432dd
SHA1 hash:
abb017cc4d20952089bf6201a9e2c76cf1efcbec
Detections:
win_formbook_g0
SH256 hash:
3090dd9fcc28d23de00ccbd3ec8a634fbcb3ca181ddad861cb4e380b48751d55
MD5 hash:
050c79b85db8e3efc6f6fde4eb22fb5e
SHA1 hash:
68edbb23139d68a7b4f9655159be7bac4f64e751
SH256 hash:
d49b25dfaec5b9aa8eb19de356122ea4c80ee55cd2b3c4d18c24f9be6328fc99
MD5 hash:
c17d3184d7eb4e47adc383af2f3c0024
SHA1 hash:
c5035f870c4f4abe303ff55a406a5c0c5a3da19b
Detections:
AutoIT_Compiled
SH256 hash:
e82d49a7282dbb896c9e5d2286f2c5575f36d5330d27a942532e19c01938d1b9
MD5 hash:
1bd37091a9130ee6baeabade878c19a0
SHA1 hash:
0fb5bf75128f3958f6136fb080f52a5b4d4b7d61
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.39
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | SUSP_Imphash_Mar23_3 |
|---|---|
| Author: | Arnim Rupp (https://github.com/ruppde) |
| Description: | Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits |
| Reference: | Internal Research |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
| Rule name: | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser |
|---|---|
| Author: | malware-lu |
| Rule name: | upx_largefile |
|---|---|
| Author: | k3nr9 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| AUTH_API | Manipulates User Authorization | ADVAPI32.dll::GetAce |
| MULTIMEDIA_API | Can Play Multimedia | WINMM.dll::timeGetTime |
| WIN_BASE_API | Uses Win Base API | KERNEL32.DLL::LoadLibraryA |
| WIN_NETWORK_API | Supports Windows Networking | MPR.dll::WNetUseConnectionW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.