MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e98006424a36e34271488f8a584b535b0bdf1650d2da228ec4c2a94e24ca20bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e98006424a36e34271488f8a584b535b0bdf1650d2da228ec4c2a94e24ca20bb
SHA3-384 hash: fb4d927ed7a2e2b040e78e1a361180a6a42874aad65a6b4f062205aaecfac2b67702a675ed18cc33184fe6aadbc76cd2
SHA1 hash: c32b592c2445ecebb542cf97150ff86fd0c896c3
MD5 hash: 38f1007dda4df73d9274b8dfa1683d93
humanhash: virginia-coffee-early-mountain
File name:38f1007dda4df73d9274b8dfa1683d93.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:718'336 bytes
First seen:2022-01-12 09:59:29 UTC
Last seen:2022-01-12 13:08:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d4d44b461c7d54870dac4fd24262a9a9 (2 x Formbook, 1 x DBatLoader)
ssdeep 12288:HB+Wk51M2qz6umSUAXwF1Oh99ojWa713rCOKGbrq9JTu7dK+/3yjc4uBd8QWOl:hnK66umSUAXweh99oj3713rRS9JJ+fyu
TLSH T139E48DEFB2A0C836D3679634FC4656B8541A7DD02F2498476FD47E1F3A78281B82B253
File icon (PE):PE icon
dhash icon f0c0db6c6a7af0fc (24 x Formbook, 6 x QuasarRAT, 5 x RemcosRAT)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
229
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
doc079982022011103755.xlsx
Verdict:
Malicious activity
Analysis date:
2022-01-12 09:08:11 UTC
Tags:
encrypted opendir exploit CVE-2017-11882 loader
Link:
https://app.any.run/tasks/fa1f0b1b-1ded-48d5-82a6-2351579b6bf7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/218661/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.52438.8331.5886.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/da2ae8a3-dfd6-4f01-81f9-47dfa4d69bb7
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/919128
Signature
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e98006424a36e34271488f8a584b535b0bdf1650d2da228ec4c2a94e24ca20bb/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-01-12 10:00:15 UTC
File Type:
PE (Exe)
Extracted files:
49
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5gaamqskg3rue4kir6ffqs2tlmf56fsq2lncfdweykuu4jgkec5q._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220112-l1nfdacbd3/
Unpacked files
SH256 hash:
5852f167948b3cf3fcd175ed0acc3cd43456ab0aecae4ac68121bde1906bcf39
MD5 hash:
bb66163c0a181098d801f3d6b775f73f
SHA1 hash:
fe4adcf4bf6146cac5b4eb192c99fc0cebba323b
Detections:
win_dbatloader_w0
Create hunting rule
Link:
https://www.unpac.me/results/1e9c1e0c-2538-46fa-8d0c-cabb6d5e90a2/
Parent samples :
8865c82943ba3a6479fca40222a730e22e3d1cd279c6c6e0915c5c47f893636a
71cf991b9060d1fcefd467162ecfe99c89c47da31d29489e299f7bec73d56a83
dc8c2ca84a7c5468cfb7b6bf59396e0333c8d145dc08fd1efbbebd9fa0082dd7
9092a8499f245641da71311b2f4dcafac1b61c30f1f5d5808fed38f5125cbc57
4cdb484aff91fc4c74a8f2750296212dd12af808fee3e01bf9b8d0feafbd8fc1
c06ba0d73edee0ae9eb7cd4631273d6afb5608b0ebf669cb250b51dfc644cb85
40a298c96e7be4f585a294ae8453cae3ba5628702462d5101ea607963041c9ad
92cee18d0c9e246f28b38a8d35442d44f8cc8eab883b5e3e0c3a09ae96de846c
1dfdb77409e4402860f9a644890b904f68d377cc5f9320828aa320b7e835e207
65c55c73382e84ea8a229ba4c65ce12c956b3e86916e343ed6e933a10735e9b1
84e9426e79655328d7e51384cd16697772d5fa8043ef793e4777ec7e3c38c6d0
778fb400067e1de625dfa7e62e7091cc28e75fc44673562dc193f4b486fdcef0
a84d4b61bab51a5eaf7d9b1a96ab450a5057ddbebb4a38617755b6286d19e9a1
83f6940a0fadd38a9a73e859f46173631822ee985037994c6c55b328721d76bf
70d04c9ec5f8c5f8a5c1cd82ad19eee2ddd26145848bc2ffe90d1b51645cac2e
f31ca1220140f0489ddef71cf10ef3636537422acaefd6dd8d9199a942feb128
e98006424a36e34271488f8a584b535b0bdf1650d2da228ec4c2a94e24ca20bb
a2948f7e3c13f7c9a54e44a6bd601ca6b8a3c2d97b7c8d6b28d1475f0caf81b8
80bee5948290fe93aa9aba9789c364c3e71f4d9039ec68a56dc05a4af7b0a502
ad2910f066744846d0233c9eb6643a71fe1643e5a107646b95c88608cddf1ed8
fdf39d043cc55d6a72b1fe01c9067bb7591d5c379798499148521e6158afeea0
c7014edceec0fbe638312dcec8b8d1f0a5bf88dd282fc8ae9ec5d375820d270d
dbb93c60e5e74632af64452fe9ec5acd788140d0eb3231655a47203e86ef6b55
feb40c343aa65f5f5c0a32443535effa22652067c576416857e4d7280ce85e11
cab5f50e805b3a36e0ea6cf84c40b4b90e372fcd2f3f1024664af5440282d496
SH256 hash:
e98006424a36e34271488f8a584b535b0bdf1650d2da228ec4c2a94e24ca20bb
MD5 hash:
38f1007dda4df73d9274b8dfa1683d93
SHA1 hash:
c32b592c2445ecebb542cf97150ff86fd0c896c3
Link:
https://www.unpac.me/results/1e9c1e0c-2538-46fa-8d0c-cabb6d5e90a2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e98006424a36e34271488f8a584b535b0bdf1650d2da228ec4c2a94e24ca20bb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe e98006424a36e34271488f8a584b535b0bdf1650d2da228ec4c2a94e24ca20bb

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/218661/
  
URLhaus
https://urlhaus.abuse.ch/url/1970292/
  
Delivery method
Distributed via web download

Comments