MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0c74afba8d113f54bfb3934d51d361939430955cced532a8268f6dcce8700a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 16

Intelligence 16 IOCs YARA 5 File information Comments

SHA256 hash:	f0c74afba8d113f54bfb3934d51d361939430955cced532a8268f6dcce8700a9
SHA3-384 hash:	b06b57cb7afeedc8c9bef92983b32476f15cae1fc33cc96a1fba6ad2e5d868d68d215ea5fc494a82bf8d82761d13a441
SHA1 hash:	12f1647537ab69c0223b5baa09b3f24803c751a1
MD5 hash:	f691d7c119df7258d6ee1e9a063d1007
humanhash:	bluebird-harry-low-cardinal
File name:	AWB.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'607'680 bytes
First seen:	2024-11-05 09:58:10 UTC
Last seen:	2024-11-05 10:01:19 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	948cc502fe9226992dce9417f952fce3 (1'182 x CredentialFlusher, 446 x Formbook, 231 x AgentTesla)
ssdeep	24576:jqDEvCTbMWu7rQYlBQcBiT6rprG8a3x86ROlotN1eTSy5oYteI4:jTvC/MTQYxsWR7a3x8wOlot2Thhe
Threatray	4'968 similar samples on MalwareBazaar
TLSH	T1EA75E00233D1C022FF9B96734B5AF6515BBC6A260123A61F13981DBAFD701B1563E7A3
TrID	68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 12.5% (.EXE) Win64 Executable (generic) (10522/11/4) 6.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
File icon (PE):
dhash icon	aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter	lowmal3
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

389

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

AWB.exe

Verdict:

Suspicious activity

Analysis date:

2024-11-05 10:04:05 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/1f6778b7-a48f-46db-8746-a5865b203f50

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.Generic.33203615.28472.17882.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6729ec6b49e92a05dde2ffed

Tags:

autorun autoit emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Creating a file

Creating a process from a recently created file

Launching a process

Сreating synchronization primitives

Enabling autorun by creating a file

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

autoit compiled-script fingerprint keylogger microsoft_visual_cc monero packed packed packer_detected

Link:

https://www.filescan.io/uploads/6729ec6ac504082537dc363c/reports/95f462ae-5256-4a16-9a78-27417654028f/overview

Verdict:

Malicious

Labled as:

Trojan.Win64.Injects

Link:

https://www.hybrid-analysis.com/sample/f0c74afba8d113f54bfb3934d51d361939430955cced532a8268f6dcce8700a9

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2336b920-3039-493f-908f-4b46416c6454

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1549120

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Binary is likely a compiled AutoIt script file

Drops VBS files to the startup folder

Found API chain indicative of sandbox detection

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: WScript or CScript Dropper

Switches to a custom stack to bypass stack traces

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f0c74afba8d113f54bfb3934d51d361939430955cced532a8268f6dcce8700a9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f0c74afba8d113f54bfb3934d51d361939430955cced532a8268f6dcce8700a9/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2024-11-05 00:01:55 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 38 (63.16%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6dduv65i2ej7ks73he2nkhjwde4ugckvztwvgkucnd3nztuhacuq._file

Verdict:

malicious

Label(s):

unknown_loader_036

Formbook

0d045677fbab19a80b17225c90ecca8fb973f67db71e7f86df8af5c25e0ac7a6

Formbook

0d9ed8e0ff58036e9395568a8979de8eeb6c96023f72479978961dd2fa5fde7f

Formbook

19d32b052f1bd0acea48d155c946166c6ed7f426d1bc2ed373b880a28e0e4fd7

Formbook

1b3639b358627ff105bdfe1ae92aa2cc385a005edbbbf3eb3d09892b72e10df4

Formbook

1f0138f02c1d1be1f9a575ffc912f443a51904558e6687af49f971ccba9711b5

Formbook

2dea6029205d48a89ccf2d373732a907328c38ea42d94244341d8c7b7b145a0b

Formbook

55d1417ff4ce962cc1b20755fe5383135f69b1d5e7aebfa50b025af27cb7a5ce

Formbook

8b7381ea399084b6999397672ad8557e74ceb6f735566143f2ea344be4d83ea5

Formbook

b5a624393544e6cb76dab6d34e0699d4f9b4155dce61ee9e3530f564841a0a96

Formbook

+ 4'958 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery

Link:

https://tria.ge/reports/241105-lz3hxazdpr/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

Drops startup file

Executes dropped EXE

Loads dropped DLL

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/4371c9f1-6c59-4b44-a7a2-fb3b6ad393db

Unpacked files

SH256 hash:

29754188230d3720835b057aed24e3c92cb94e818f6ce8bc4c2f7e6f6573c84a

MD5 hash:

fb26378f5d05151f5fd2c6e45b682285

SHA1 hash:

398613e165c3b48ff0bcb61b560f4d0da7377f0b

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/a0be009e-3079-4739-a329-cbcddda6cbc0/

Parent samples :

f0c74afba8d113f54bfb3934d51d361939430955cced532a8268f6dcce8700a9
c5a0093fbe23781df248331f8e2ecd613aa8fafc31a0dc9b00d2fa193c6cc970
b365215db2a43106d746921ff99c7a8a6c2fc80965dc1567480a38021366848d
ca6e99cb086dcbdeaa2e6dcefd08a5907eb2f6b0cee11da6aef68818bbdaa72b
593c8605076c650720fcdfa1fada91472d792da661c0f6713f857a9780a6a6eb
2e2295a9381043fcd7cf663e6eaa6bf154eb72fbcfb1c427db155b9f0e4e4d35
67f01ea4fc25ae9f1a4ab574e0c474bd31ae7d561abc545bb65ca86d26f3daa5
dab3c27ad67888d0202abfd11c7fc17d62d501dd611d6f46756bfefe246b06e5
80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d
0483b0d294c1acf6cec539e7cddd014e31de6de3966fa3c6517877fbd29bfee1

SH256 hash:

6330395f4a38f01512cf834457f8b6adedabf418697dc56f7cdf88f6b92377e4

MD5 hash:

bf0fdf8ac2abdb96022fc548a69fafa5

SHA1 hash:

b5819bc239c0e6118a29650811a02d92f533af4b

Link:

https://www.unpac.me/results/a0be009e-3079-4739-a329-cbcddda6cbc0/

SH256 hash:

f0c74afba8d113f54bfb3934d51d361939430955cced532a8268f6dcce8700a9

MD5 hash:

f691d7c119df7258d6ee1e9a063d1007

SHA1 hash:

12f1647537ab69c0223b5baa09b3f24803c751a1

Link:

https://www.unpac.me/results/a0be009e-3079-4739-a329-cbcddda6cbc0/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f0c74afba8d1/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f0c74afba8d113f54bfb3934d51d361939430955cced532a8268f6dcce8700a9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	pe_detect_tls_callbacks Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

exe f0c74afba8d113f54bfb3934d51d361939430955cced532a8268f6dcce8700a9

(this sample)

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::AllocateAndInitializeSid ADVAPI32.dll::CopySid ADVAPI32.dll::FreeSid ADVAPI32.dll::GetLengthSid ADVAPI32.dll::GetTokenInformation ADVAPI32.dll::GetAce
COM_BASE_API	Can Download & Execute components	ole32.dll::CLSIDFromProgID ole32.dll::CoCreateInstance ole32.dll::CoCreateInstanceEx ole32.dll::CoInitializeSecurity ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::mciSendStringW WINMM.dll::timeGetTime WINMM.dll::waveOutSetVolume
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAce ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::CheckTokenMembership ADVAPI32.dll::DuplicateTokenEx ADVAPI32.dll::GetAclInformation ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExW SHELL32.dll::ShellExecuteW SHELL32.dll::SHFileOperationW
WIN32_PROCESS_API	Can Create Process and Threads	ADVAPI32.dll::CreateProcessAsUserW KERNEL32.dll::CreateProcessW ADVAPI32.dll::CreateProcessWithLogonW KERNEL32.dll::OpenProcess ADVAPI32.dll::OpenProcessToken ADVAPI32.dll::OpenThreadToken
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::SetSystemPowerState KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileExW KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW IPHLPAPI.DLL::IcmpCreateFile KERNEL32.dll::CreateFileW
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameW ADVAPI32.dll::GetUserNameW ADVAPI32.dll::LogonUserW ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_API	Supports Windows Networking	MPR.dll::WNetAddConnection2W MPR.dll::WNetUseConnectionW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegConnectRegistryW ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::BlockInput USER32.dll::CloseDesktop USER32.dll::CreateMenu USER32.dll::EmptyClipboard USER32.dll::FindWindowExW USER32.dll::FindWindowW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample