MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec34c3db0d2c865486e52760c0d35dab95adcb3544f2e03f5023495d112d64ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec34c3db0d2c865486e52760c0d35dab95adcb3544f2e03f5023495d112d64ba
SHA3-384 hash: 2101b3ddc04db3c7ac1d70ac968ccd31c8c4e5d09ab285af02492989e361e3223d4826f22c9baf0d6ac1e4dd92457b5d
SHA1 hash: 5001c5fb341d70009af0c19297e8d285878f9a08
MD5 hash: 322bcf9b3f0b67dd9355dc8a68a3e121
humanhash: diet-september-pip-maryland
File name:Shipping Documents pdf.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:401'408 bytes
First seen:2020-08-14 06:06:32 UTC
Last seen:2020-08-14 06:49:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 6144:8TEv3rYrju+w5oIVMxHDMXWKxxIT6XOhkZ7+u84o39ZaiV74supt0u:8TE2c/+gXtxG6BMu8r9ZaiVDuQ
Threatray 2'240 similar samples on MalwareBazaar
TLSH 5284DF3E02F1D509C07BF13EA255518BB1E79C4B04A6C71A69AD0DE80E385E70AA7DFD
Reporter cocaman
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/45526/
Detection(s):
SecuriteInfo.com.Trojan.Siggen10.4036.11382.7880.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/428624
Signature
Benign windows process drops PE files
Binary contains a suspicious time stamp
Detected FormBook malware
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 266824 Sample: Shipping Documents pdf.exe Startdate: 15/08/2020 Architecture: WINDOWS Score: 100 54 Malicious sample detected (through community Yara rule) 2->54 56 Yara detected AntiVM_3 2->56 58 Yara detected FormBook 2->58 60 5 other signatures 2->60 10 Shipping Documents pdf.exe 3 2->10         started        process3 file4 46 C:\Users\...\Shipping Documents pdf.exe.log, ASCII 10->46 dropped 74 Writes to foreign memory regions 10->74 76 Injects a PE file into a foreign processes 10->76 14 RegSvcs.exe 10->14         started        17 RegSvcs.exe 10->17         started        signatures5 process6 signatures7 78 Modifies the context of a thread in another process (thread injection) 14->78 80 Maps a DLL or memory area into another process 14->80 82 Sample uses process hollowing technique 14->82 84 Queues an APC in another process (thread injection) 14->84 19 explorer.exe 3 6 14->19 injected 86 Tries to detect virtualization through RDTSC time measurements 17->86 process8 dnsIp9 48 www.niulunbi.com 154.86.195.36, 49746, 80 DXTL-HKDXTLTseungKwanOServiceHK Seychelles 19->48 50 www.saulshandyman.com 19->50 52 www.gzslmfs.com 19->52 40 C:\Users\user\AppData\Local\...\hxw4as2k.exe, PE32 19->40 dropped 62 System process connects to network (likely due to code injection or exploit) 19->62 64 Benign windows process drops PE files 19->64 24 msdt.exe 1 17 19->24         started        28 hxw4as2k.exe 2 19->28         started        30 hxw4as2k.exe 1 19->30         started        file10 signatures11 process12 file13 42 C:\Users\user\AppData\...\901logrv.ini, data 24->42 dropped 44 C:\Users\user\AppData\...\901logri.ini, data 24->44 dropped 66 Detected FormBook malware 24->66 68 Tries to steal Mail credentials (via file access) 24->68 70 Tries to harvest and steal browser information (history, passwords, etc) 24->70 72 3 other signatures 24->72 32 cmd.exe 1 24->32         started        34 conhost.exe 28->34         started        36 conhost.exe 30->36         started        signatures14 process15 process16 38 conhost.exe 32->38         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ec34c3db0d2c865486e52760c0d35dab95adcb3544f2e03f5023495d112d64ba/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 06:08:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5q2mhwynfsdfjbxfe5qmbu25vok23szvitzoap2qenev2ejnms5a._file
Verdict:
malicious
Similar samples:
1bfdb7e4f0aadba330b6017c2608570e791bfddff789d128ecb5ca9a5a06e6fe
FormBook
442452b82edb2b18431c296669c78df1c88b210775e9a9b5d7726a1092a8fc6f
FormBook
6ff25388a91cbed0a11467e592e39e34c54de49d61876a2a201554e67c5b8cb4
FormBook
7bee02185a682294214d68a1c41ed3e0ebc53b275b200fd8b4a03fc92e1c463a
FormBook
854146ab0835f912d31018649e0f97ebde7a2267ec1085a36bc0dc73f5b6f2a9
FormBook
8fa9dd16bb791bea50566208c8b216acc3c41e5c65495f34c3dcf99c595fccc8
FormBook
d6cfa16240c572c1d310d0e3f9a3a48254103dbfdaf47d08b31bd255a6022d50
FormBook
db31ede125999d44d9c886d76eb8d5c5ee280f17130e3e3138bf1f76935d1b99
FormBook
dda62be10b5d6c904c056f244d721e7dfc5bd60d033992a4763fb1105e0c334f
FormBook
f3a30108ab40b7f31ad7ad191bb41bd3ad148d09597705c1ec0bc0352d18c29e
FormBook
+ 2'230 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/200814-a2ffade47j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.funpexw.com/kdz/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ec34c3db0d2c865486e52760c0d35dab95adcb3544f2e03f5023495d112d64ba

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

r00 751382c5ae135d48b3fccfdd02b42c3cc27d664610acb06f4c73343e50e863bb

FormBook

Executable exe ec34c3db0d2c865486e52760c0d35dab95adcb3544f2e03f5023495d112d64ba

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 751382c5ae135d48b3fccfdd02b42c3cc27d664610acb06f4c73343e50e863bb
Cape
Cape
https://www.capesandbox.com/analysis/45526/

Comments