MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0f6a0343f0b9098fea8d51ce1951b39922fc9d64fe47467a2df178f13daa4e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0f6a0343f0b9098fea8d51ce1951b39922fc9d64fe47467a2df178f13daa4e2
SHA3-384 hash: 081275956b25827dfcf7024bab4f752fd45e43236b3651b3645aa0e94edd912ecbfeb149f01a4c62814ebe58e8f41bdb
SHA1 hash: 766cb691f7b75b5dd97c1de6cf2c30ca4b7d1dd3
MD5 hash: 5c1fcaf45382293c1fffbb741328adae
humanhash: pennsylvania-sixteen-bravo-jig
File name:SecuriteInfo.com.Variant.Jaik.86453.32732.6529
Download: download sample
Signature Formbook
Create hunting rule
File size:1'715'144 bytes
First seen:2022-07-14 13:36:44 UTC
Last seen:2022-07-14 21:57:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9e36edbcfe4251ed84bc1512e28329d7 (1 x Formbook, 1 x RecordBreaker)
ssdeep 49152:d4752bxR0bfGJ3RjHawG6tNCnd1OiUd7BF1p:O7UVEfGhRrqgN0d0dF1p
TLSH T1B985D051D20A822AE46E5C7CEFC9E4F105F6FD4B9C86E793A05CAD0376830227B2DD56
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 032751535171233e (1 x Formbook)
Reporter SecuriteInfoCom
Tags:exe FormBook signed

Code Signing Certificate

Organisation:*.clipstudio.net
Issuer:Amazon
Algorithm:sha256WithRSAEncryption
Valid from:2022-04-29T00:00:00Z
Valid to:2023-05-28T23:59:59Z
Serial number: 0912426e1edb5c821c5f114e21df0e45
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: e5cf0f219d3ce81085b6e2397d4200bdd43bbb827d4e44f84bbcd732887f1bb3
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
292
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Variant.Jaik.86453.32732.6529
Verdict:
Malicious activity
Analysis date:
2022-07-14 15:08:52 UTC
Tags:
formbook trojan stealer
Link:
https://app.any.run/tasks/5e4b3d03-7c14-4b30-bb66-1eba77918eb3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/289124/
Detection(s):
SecuriteInfo.com.Variant.Jaik.86453.32732.6529.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Сreating synchronization primitives
Searching for synchronization primitives
Launching cmd.exe command interpreter
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Reading critical registry keys
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/62d01c070f510051d9f1de90/reports/b042a9f5-36c2-418b-b7ee-d47f7a7029ed/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1031453
Behaviour
Behavior Graph:
n/a
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f0f6a0343f0b9098fea8d51ce1951b39922fc9d64fe47467a2df178f13daa4e2/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-07-14 07:23:06 UTC
File Type:
PE (Exe)
Extracted files:
16
AV detection:
21 of 26 (80.77%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6d3kanb7boijr7vi2uoodfi3hgjc7sowj7shiz5c34ly6e62utra._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:mt88 loader persistence rat suricata
Link:
https://tria.ge/reports/220714-qwsxhsbdf6/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds policy Run key to start application
Xloader payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
491b58cd14ab3e8d5c43f94a562342201d12c0ae0ef4900562525caf02342a3e
MD5 hash:
2940263c7ca3f82b3f9c7936b3128e58
SHA1 hash:
aa233f71dde2ca9030c4ab997245297c45f86fc5
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
XLoader
Create hunting rule
Link:
https://www.unpac.me/results/b1d19bcd-d817-445a-b72a-00f98c393407/
Parent samples :
b8cef7577e09d894f2136407634962aa9574f00c3c09651cafeffbed4e9b220a
1bec941f244d3f69b90f2b3166509ccffdfb11959003f53c1ef097beaf4a0969
4e586d008dc06d3c77d590393b4e565273b30ef2b536a193976c9a82353878bf
83a0a2a03abf589609e19e89ef491d9465d26db00c5e4db3a04da61a121af232
e4368355994cacf472d053ff31a672820b4a293b7f7cff9eb1347dbe5335c9d7
1ac4761ba49aff4b12b8dec8e72e5ef20ae8abfab93b8cbff2d3170267c0e79c
f0f6a0343f0b9098fea8d51ce1951b39922fc9d64fe47467a2df178f13daa4e2
a8ee338d80b7be8f4e1bc7b6fa10890a9f5575ea4ea8fa3db547f9f0abc22c64
SH256 hash:
34e43a470b281d25aacbf0ffda79747b94c0a868be920a2505d4d68abb357315
MD5 hash:
2220432aeeab867f389b22f55688ff39
SHA1 hash:
475736e1aa5643e0346df338505814595ccdd0b6
Link:
https://www.unpac.me/results/b1d19bcd-d817-445a-b72a-00f98c393407/
SH256 hash:
f0f6a0343f0b9098fea8d51ce1951b39922fc9d64fe47467a2df178f13daa4e2
MD5 hash:
5c1fcaf45382293c1fffbb741328adae
SHA1 hash:
766cb691f7b75b5dd97c1de6cf2c30ca4b7d1dd3
Link:
https://www.unpac.me/results/b1d19bcd-d817-445a-b72a-00f98c393407/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/f0f6a0343f0b9098fea8d51ce1951b39922fc9d64fe47467a2df178f13daa4e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:malware_Formbook_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.formbook.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/289124/

Comments