MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8 |
|---|---|
| SHA3-384 hash: | 7d053a2af2cf1a7e38c01f3872752b88a258c984a70c0856afb5e4fd8ec0a162c157335082111a283c708dcfa0c3bcc3 |
| SHA1 hash: | 56884811262008dd1d364d2b9cde2383ae9946b9 |
| MD5 hash: | 6ce870a87a39787ab4fa77da3fec640f |
| humanhash: | kitten-fish-undress-muppet |
| File name: | rRICO0928-2023.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 621'568 bytes |
| First seen: | 2023-11-23 15:58:06 UTC |
| Last seen: | 2023-11-23 17:16:09 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'202 x SnakeKeylogger) |
| ssdeep | 12288:h8oU24xPyMrknWwli74hhYglFSXQDZ3B5tQrS5ninWzIGWJ:afxnkWw41gHSXMZntQrKedG |
| Threatray | 143 similar samples on MalwareBazaar |
| TLSH | T174D4230268A45B31CC6673F3CDE1269DA3B2D85E5A66D79A4CC530CC2DB370147A6FA3 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  FXOLabs |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
356
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
New Docs 11_22 Weihnachtsbrief-password(Jy5topDG).zip
Verdict:
Suspicious activity
Analysis date:
2023-11-23 15:35:09 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Launching a process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Malware
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus detection for URL or domain
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-11-22 10:38:02 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
18 of 23 (78.26%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 133 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Unpacked files
SH256 hash:
96adebe2d3724b09c5f8d594729bbf9b084d9b6dff3398c5e1c7d79d0ca642e3
MD5 hash:
66177a12d0bc968626c1716133a08e46
SHA1 hash:
df395156d246854650801b46607b4a1b2ba47721
SH256 hash:
a0f01eaf0772e8a22deec7deaffe23c78790261a8e917005e7796e12f4b89b6d
MD5 hash:
2d194f56ed6fd1e15d977f873b63df83
SHA1 hash:
adf44b215e43477d8e70b942c528a83df3837c7b
SH256 hash:
3fc435481d7ef0079bdad4dd86185e61a5092a5df4a3e17a75266cf283effaa1
MD5 hash:
ead80ad88662af6f37f0c49fe6e3fb44
SHA1 hash:
dbeb4019c7337347d1c6d0913c9249021cafd849
SH256 hash:
dd36fbc0e05ca2b89476516ef20b924cb72721efcebcb975714d5dbaf946dd68
MD5 hash:
5c51d28ec4745360517dfeb8a15ec71e
SHA1 hash:
a5139226b8ec9bc9e2866de7b7291ad6c2f36cc5
SH256 hash:
18248f007e0342921d14b044001395c8447b73534cfee7a4c89a90e681b51a6b
MD5 hash:
adad3a3e7925f43b9f797f289d25f890
SHA1 hash:
4e7d436dc161026da67ef02b78acf02d7d9b38dc
SH256 hash:
ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8
MD5 hash:
6ce870a87a39787ab4fa77da3fec640f
SHA1 hash:
56884811262008dd1d364d2b9cde2383ae9946b9
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AgentTesla_DIFF_Common_Strings_01 |
|---|---|
| Author: | schmidtsz |
| Description: | Identify partial Agent Tesla strings |
| Rule name: | BitcoinAddress |
|---|---|
| Author: | Didier Stevens (@DidierStevens) |
| Description: | Contains a valid Bitcoin address |
| Rule name: | DebuggerCheck__GlobalFlags |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Active |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Thread |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | Formbook |
|---|---|
| Author: | kevoreilly |
| Description: | Formbook Payload |
| Rule name: | maldoc_find_kernel32_base_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | maldoc_getEIP_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Windows_Trojan_Formbook |
|---|---|
| Author: | @malgamy12 |
| Rule name: | Windows_Trojan_Formbook_1112e116 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_formbook_w0 |
|---|---|
| Author: | @malgamy12 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.