MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eafdcbea5a9544d87f8a7c03ee4eb6ab0d9c12bbbbc1d9705dc94d5fd983c5bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eafdcbea5a9544d87f8a7c03ee4eb6ab0d9c12bbbbc1d9705dc94d5fd983c5bd
SHA3-384 hash: 104e3d738a40d939b7c152af1250e275499647f3884a2995a2511b30622891c8ab0d57c5670650b3ae70f16e12105e94
SHA1 hash: 7c3486e278128df7ff249a2844c8f8fd116e8128
MD5 hash: dec61c40661c7a5b70eab12cfead3e70
humanhash: ink-earth-venus-one
File name:dec61c40661c7a5b70eab12cfead3e70.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:15'872 bytes
First seen:2022-02-24 08:56:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 192:LUR0zwhCkN5Q8a/hCGg/2Ojdu6kYfDCHSEsgIJAShV:LUgwhCKmvCGguOjdu6k4DCy09u
Threatray 13'761 similar samples on MalwareBazaar
TLSH T19562720C73A0029AC95F0EB369A20A25E377A0C7D5A3865D58BF40F54E3978593CBF5E
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
196
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
OLE_CVE-2017-11882.xls
Verdict:
Malicious activity
Analysis date:
2022-02-24 05:57:43 UTC
Tags:
encrypted exploit CVE-2017-11882 loader trojan formbook stealer
Link:
https://app.any.run/tasks/7a7b3b05-a9cb-4ea6-9c44-7f7e5cd063b1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/244162/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6217486ea6f52d32f17f3442/reports/c997efba-f7c3-43a2-ac28-915b61c1b257/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/32e9e40a-b5a1-4a14-a44d-fecab4eee358
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/945661
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 578142 Sample: sZAAMl5q5s.exe Startdate: 24/02/2022 Architecture: WINDOWS Score: 100 35 Multi AV Scanner detection for domain / URL 2->35 37 Found malware configuration 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 8 other signatures 2->41 10 sZAAMl5q5s.exe 15 3 2->10         started        process3 dnsIp4 31 olypath.com 178.18.193.160, 49710, 80 VARGONENTR Turkey 10->31 33 cdn.discordapp.com 162.159.135.233, 443, 49709 CLOUDFLARENETUS United States 10->33 29 C:\Users\user\AppData\...\sZAAMl5q5s.exe.log, ASCII 10->29 dropped 51 Tries to detect virtualization through RDTSC time measurements 10->51 15 sZAAMl5q5s.exe 10->15         started        file5 signatures6 process7 signatures8 53 Modifies the context of a thread in another process (thread injection) 15->53 55 Maps a DLL or memory area into another process 15->55 57 Sample uses process hollowing technique 15->57 59 Queues an APC in another process (thread injection) 15->59 18 explorer.exe 15->18 injected process9 process10 20 svchost.exe 18->20         started        signatures11 43 Self deletion via cmd delete 20->43 45 Modifies the context of a thread in another process (thread injection) 20->45 47 Maps a DLL or memory area into another process 20->47 49 Tries to detect virtualization through RDTSC time measurements 20->49 23 cmd.exe 1 20->23         started        25 explorer.exe 135 20->25         started        process12 process13 27 conhost.exe 23->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eafdcbea5a9544d87f8a7c03ee4eb6ab0d9c12bbbbc1d9705dc94d5fd983c5bd/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-02-24 08:57:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
15 of 28 (53.57%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
02c848711be5356cc435b98837bdf0120cac86fdeaa5238793a3ab6300482147
Formbook
08d17b9c0d3ab4eb79a38b0a500655f9f47bc3468718ae5b61d59d0b2b687e53
Formbook
0b7b92e40a75e7c96676e65733f2babfdf0c37529c130619510b2b0b7879a697
Formbook
0d0a72e23a95a6e537d344e6acab903e09793a4b652cad815daf9b8bab23b47f
Formbook
0da36b7f7e4b44b640ab5769532fdd7599032ca2b1d6b57807ba48ad1fa76780
Formbook
1ec8f5c2a626d9484af9532ed48a5b7482fc0dcdab074d8545ac8e4454c68a89
Formbook
28562d1e97597dbe302d550277e91bd4aa6869bd3d356668bc7c48b2b6eaa3d1
Formbook
982e727a53a27d2bfbaea608209b315bc892947a1ef954033f1b29c687b6e001
Formbook
9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e
Formbook
fc35540b602ba860b10c2b43261657a7e2b9fc1d3aa8104272f2255a664fabd7
Formbook
+ 13'751 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:b80i loader rat
Link:
https://tria.ge/reports/220224-kwlkjsced6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Downloads MZ/PE file
Xloader Payload
Xloader
Unpacked files
SH256 hash:
eafdcbea5a9544d87f8a7c03ee4eb6ab0d9c12bbbbc1d9705dc94d5fd983c5bd
MD5 hash:
dec61c40661c7a5b70eab12cfead3e70
SHA1 hash:
7c3486e278128df7ff249a2844c8f8fd116e8128
Link:
https://www.unpac.me/results/baa39b07-a6de-4661-b436-f08f94b5607b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/eafdcbea5a9544d87f8a7c03ee4eb6ab0d9c12bbbbc1d9705dc94d5fd983c5bd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe eafdcbea5a9544d87f8a7c03ee4eb6ab0d9c12bbbbc1d9705dc94d5fd983c5bd

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2046524/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/244162/

Comments