MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f34b081e06b7cfcdabd9055fad7790bc66a20d62846172a24f914bf2d5298432. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f34b081e06b7cfcdabd9055fad7790bc66a20d62846172a24f914bf2d5298432
SHA3-384 hash: 630fae7e5b84a7273c0a3697e444189e03f835ed8ebeb14bbff14786ab02abe5b89592f8c58c44b2913cd88be82c9eba
SHA1 hash: 0ba9a342d8a272b79df4c568935a4d43a7eb8fab
MD5 hash: 43320327d59a74c788a0aa4919eff41f
humanhash: butter-thirteen-north-crazy
File name:Proforma Invoice-Bank Advice (PAID) Attached.pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'375'232 bytes
First seen:2021-09-28 08:18:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:y/TN6MmijS5zt8P/F1AxFb5aD9fxfyp+l7f8Z8PTVCoGnIF/OiC79HKYw2nA6JBj:sLS5aF1AxFb5aDBJLCIF0BZ5nNJaJkj
Threatray 9'669 similar samples on MalwareBazaar
TLSH T15B558D54386ACBAAD15F1B79C4E75000C769ACA17599E71F7FCA32DE1D403AF980828F
Reporter GovCERT_CH
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Proforma Invoice-Bank Advice (PAID) Attached.pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-09-28 08:20:53 UTC
Tags:
trojan formbook stealer
Link:
https://app.any.run/tasks/bfb562ca-9826-4dc4-be41-000eff27dc1d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/192435/
Detection(s):
SecuriteInfo.com.Trojan.Fbng.72.17279.20980.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/48533511-4ed5-4bfc-8996-d905641b23e8
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/859634
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Self deletion via cmd delete
Sigma detected: Suspicious Double Extension
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Uses netstat to query active network connections and open ports
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 492063 Sample: Proforma Invoice-Bank Advic... Startdate: 28/09/2021 Architecture: WINDOWS Score: 100 31 www.parser4.plus 2->31 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus detection for URL or domain 2->43 45 11 other signatures 2->45 11 Proforma Invoice-Bank Advice (PAID) Attached.pdf.exe 3 2->11         started        signatures3 process4 file5 29 Proforma Invoice-B...ttached.pdf.exe.log, ASCII 11->29 dropped 59 Injects a PE file into a foreign processes 11->59 15 Proforma Invoice-Bank Advice (PAID) Attached.pdf.exe 11->15         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 Queues an APC in another process (thread injection) 15->67 18 explorer.exe 15->18 injected process9 dnsIp10 33 www.wellnesswithchefsuzanne.com 18->33 35 www.nanosep-therapeutics.com 18->35 37 wellnesswithchefsuzanne.com 34.102.136.180, 49825, 80 GOOGLEUS United States 18->37 47 System process connects to network (likely due to code injection or exploit) 18->47 49 Uses netstat to query active network connections and open ports 18->49 22 NETSTAT.EXE 18->22         started        signatures11 process12 signatures13 51 Self deletion via cmd delete 22->51 53 Modifies the context of a thread in another process (thread injection) 22->53 55 Maps a DLL or memory area into another process 22->55 57 Tries to detect virtualization through RDTSC time measurements 22->57 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f34b081e06b7cfcdabd9055fad7790bc66a20d62846172a24f914bf2d5298432/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-25 11:23:59 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6nfqqhqgw7h43k6zavp2254qxrtkedlcqrqxfispsff7fvjjqqza._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
043b45f9d94820186d7324c5f6e0fd7661de15ad29104fd43294e2f3839efa06
Formbook
4c5887639c1dfcc0349690d98e9c8034029a6fa2f2e6bdbba96371bf23ce3301
Formbook
6bb763ffd1ca484344f2a02df3f9e6bddc18a0f1fcd5d58002ad16b82b36db90
Formbook
6bcdb1b6795c22308aee5d390cfae409d21a3238a304466dd54c1dee43570afd
Formbook
6c0e85b84f2b1dfdb580a168386ad91efe7f734066ff3a12a0d359fcb4711dca
Formbook
972f5e016ffc306524d7083a5a5058ba8b5fc60f3db9f3c0915db59c0523a487
Formbook
9d503fba930fcf9724778a17659948875302b2fc7148c82779c29dfc18fb8cc3
Formbook
a99b696e8ac16303843b26c95c982d5be9b9fd657d843937cc586c9a8dc29b83
Formbook
af0af3ebf3ac231ad77dbe4cbfa0fb2d48312d4ca0b5431081046ab09aa3b552
Formbook
b11a7103f96fb02a8df7ad0e821f0083f48f56cc38df47d8573f39c0d4a19235
Formbook
+ 9'659 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:im8r rat spyware stealer trojan
Link:
https://tria.ge/reports/210928-j7vf6abbc4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.mashup.agency/im8r/
Unpacked files
SH256 hash:
08dd4b9dbfab34a687b2e3317c4a2d7d17546005b8bd57bad8fba973cbc638c8
MD5 hash:
a60c503e7d91d20e596e53db2e70ea1c
SHA1 hash:
87905808f532bcef32a61b43044378b1131f102b
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/218241da-eb9e-4bba-8bdf-986312ec5744/
Parent samples :
6bcdb1b6795c22308aee5d390cfae409d21a3238a304466dd54c1dee43570afd
f34b081e06b7cfcdabd9055fad7790bc66a20d62846172a24f914bf2d5298432
SH256 hash:
840224dbd62cb653ef0749e5ca37460d2c277f4879859b09fe31a4e94057a7ff
MD5 hash:
fd67468e957d81a11ed1201feecf310f
SHA1 hash:
b95e69a2d75caa83b7b532f51ffc20c5af6f830e
Link:
https://www.unpac.me/results/218241da-eb9e-4bba-8bdf-986312ec5744/
SH256 hash:
efd2f7657839b252c2fb8489c1ccf610b8e57b471efe049de86a74bc1506775d
MD5 hash:
c3f3e4a9e9ab54bf847a9fc02e7a2160
SHA1 hash:
0853bec33e36ede763927cda0f03129ca763bc07
Link:
https://www.unpac.me/results/218241da-eb9e-4bba-8bdf-986312ec5744/
SH256 hash:
920468a3eaa3575cc8702ac88e7c7418858065e4faef92e96aca528eed651d04
MD5 hash:
2274eda7058373e76843a754f2488ce6
SHA1 hash:
01dcf18ab18883c0e197ae4890d54ca93fc233e4
Link:
https://www.unpac.me/results/218241da-eb9e-4bba-8bdf-986312ec5744/
SH256 hash:
f34b081e06b7cfcdabd9055fad7790bc66a20d62846172a24f914bf2d5298432
MD5 hash:
43320327d59a74c788a0aa4919eff41f
SHA1 hash:
0ba9a342d8a272b79df4c568935a4d43a7eb8fab
Link:
https://www.unpac.me/results/218241da-eb9e-4bba-8bdf-986312ec5744/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.79
Link:
https://yomi.yoroi.company/submissions/f34b081e06b7cfcdabd9055fad7790bc66a20d62846172a24f914bf2d5298432

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe f34b081e06b7cfcdabd9055fad7790bc66a20d62846172a24f914bf2d5298432

(this sample)

  
Dropped by
formbook
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/192435/

Comments