MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ed634911cd271d95fde0200d57e20a5d16a33580ae196d97efcc8b3002a5ebc9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | ed634911cd271d95fde0200d57e20a5d16a33580ae196d97efcc8b3002a5ebc9 |
|---|---|
| SHA3-384 hash: | 98948e281c7cf29944721458120c2c69a66a5ffd7fdb12cf3001867dce198d06736213ccab41f7864c8dd753c0a196bf |
| SHA1 hash: | 661f3d1c05d90950d65062cc525bfd9788761012 |
| MD5 hash: | 8b2df1b36406eae2af3c5055a88acdd3 |
| humanhash: | purple-spring-fourteen-butter |
| File name: | AWB 9899691012 Clearance Doc_pdf.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 669'184 bytes |
| First seen: | 2023-11-20 06:46:37 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:eC361h61EWGfPJdtu24qbVTrMgKNI94EOTE0+M/NZgsD+5o9jwRbUcqn31Z61:eXY7GZdo2NVo694EO4E/ksk9ocq6 |
| TLSH | T190E4232A3F64D6A3C6CA80F510B57E9057B3FA589C11D8FC5ECB21AE098DBC65203A57 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | c4c6dcccecf8b4b8 (12 x AgentTesla, 3 x Formbook, 2 x RemcosRAT) |
| Reporter |  lowmal3 |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
288
Origin country :
DEVendor Threat Intelligence
Detection:
Formbook
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Launching a process
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-11-20 03:52:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
16 of 22 (72.73%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Unpacked files
SH256 hash:
d64c9796114f05fcdb886b9ec12794e2b5a9abdc7af43ffe4b188258b0c6247e
MD5 hash:
af68b5b2076e41f2661538c12ceb7ac9
SHA1 hash:
0e1d9e9972ccc9c9a441bccf0885995ccb2fc787
Detections:
win_formbook_w0
win_formbook_g0
SH256 hash:
0a351e21008b1210125bc55edc9838942ad40a8e64fd28dada7cfdbf728b7e6e
MD5 hash:
4818f50f932b66aecaf32630944c4717
SHA1 hash:
2a823c0d41a3e0feed74f31bbc0042473aed3a11
SH256 hash:
797e57bd74a68f7b4808a213f5c319ee4f4b023bc73088175d4393dfee9fe329
MD5 hash:
3c927935fbd608e7628cc2c5ad7d52fd
SHA1 hash:
ee0c880c0614ac960fd641f7d479233584aed1d8
SH256 hash:
e82edbf98eb0461af0ba9169974b3308db2886974d2828134e5d1b6f081f49bb
MD5 hash:
e4367a5c7f294742c9c3cd8b128cf2e8
SHA1 hash:
9da55415ba06ba138562075efd85c52144376000
SH256 hash:
80e51b38f8ec7e3f52f01a8f7a3b8af712bbf5c980a78f93053f42bdc95d0672
MD5 hash:
6ad839f8593b86aff3f350742c3169a0
SHA1 hash:
268eafebb6129ae7c1b08ef9644b9066f5055438
SH256 hash:
e7be67fa0bf252abd9e9ab1f4ce0a3237a2e346924b4d53e6714a6008a801df2
MD5 hash:
0560141798df53351d7d175e213e0674
SHA1 hash:
e4ce14eef5ce2a50da33cd6b908398bf7b42aa13
SH256 hash:
57b70789d2a8d94488fc446690c7dc133b4770b13200df6231d5ab39faa903ad
MD5 hash:
38a9a913e86fa1d1087d7d22bc203f2d
SHA1 hash:
b7f2246aae5bc7c1415539ef6cb768d49099de31
SH256 hash:
0beaef32651be311a9d64c09f9a58aabb2e21d225458877760e04b56cc3ae145
MD5 hash:
22472fefa8ddab58f683713e563e859c
SHA1 hash:
ae59a25a87377a0d6dfd4e9bac18e264b75ae540
SH256 hash:
40c124657a9c2b7ac08ce923dfab5564a2a7e7be0c2859af0e12c6da8b89a2bb
MD5 hash:
8136bbf906cb7c62f335aa7ebd9f9ef8
SHA1 hash:
73a91961e9ee9fba92e5eedb7e9bab683dfd588d
SH256 hash:
db42cadec1e46fcea587246728aecab4ea8850447e372c86b7482bec34b43b0c
MD5 hash:
d977db48c2d52eee21098faca3cca0cb
SHA1 hash:
6fac1d5b38946820f6b34c4422f206996d7fc477
SH256 hash:
d847ebfc8125faa879412080557ac29a4fc23cef2fb1de04d6182cad7e889dc2
MD5 hash:
db5901d027af2aeb8b1b9a13a3c4cd43
SHA1 hash:
4d5db419095c08b42c76a7733945006873b4ca38
SH256 hash:
ed634911cd271d95fde0200d57e20a5d16a33580ae196d97efcc8b3002a5ebc9
MD5 hash:
8b2df1b36406eae2af3c5055a88acdd3
SHA1 hash:
661f3d1c05d90950d65062cc525bfd9788761012
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.