MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef14e580eca50b75acae60fa7c6642fa89fc91ee8492f5193608937f4d78781b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef14e580eca50b75acae60fa7c6642fa89fc91ee8492f5193608937f4d78781b
SHA3-384 hash: ce58b0463577a941e015c69ec897e29054655f600f656ac7965cb4badfbf09062e955b083b10bf0636e46f0cb8791b80
SHA1 hash: 98f5fa7f3590390422e8cc496a19bb9db07a1f0f
MD5 hash: 074cbc3f988678afc1fd7c78a85a09d7
humanhash: oven-edward-virginia-mars
File name:86HTe(2).exe
Download: download sample
Signature FormBook
Create hunting rule
File size:790'528 bytes
First seen:2020-04-27 06:41:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0318ec2c3e20540fe0ccf697fa352b5b (4 x FormBook, 2 x Loki, 2 x AgentTesla)
ssdeep 12288:9MwW5CcA25doqMiR3jfdKWVGKiwqd+ecWJGyhJussNvxwPcQ/:b8C2xVrdVMpn+ePA5sko
TLSH A9F4BF26F2D14837D1732A7CBD5B5294A83A7E103B3998462BF42D4C5F397913E3A287
Reporter oppimaniac
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.LokiBot-7699946-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.GenKryptik.EIOO.20590.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-27 07:35:29 UTC
File Type:
PE (Exe)
Extracted files:
40
AV detection:
27 of 30 (90.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=54kolahmuufxllfomd5hyzsc7ke7zepoqsjpkgjwbcjx6tlypanq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FormBook

Executable exe ef14e580eca50b75acae60fa7c6642fa89fc91ee8492f5193608937f4d78781b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/348813/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteExA
shell32.dll::ShellExecuteA
shell32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments