MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3a30108ab40b7f31ad7ad191bb41bd3ad148d09597705c1ec0bc0352d18c29e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f3a30108ab40b7f31ad7ad191bb41bd3ad148d09597705c1ec0bc0352d18c29e
SHA3-384 hash: 589607e600ea94a437818be3e7a1ea63e33b3d0d0f9f7100fd02d4f8f54855f8e6057ab0950c8ca9bdaf8bc493469c81
SHA1 hash: 28071db792d8f840807b428eb45e4aa8c205987f
MD5 hash: a7193f4953383aff6d14d9b85895d137
humanhash: winner-california-sweet-lithium
File name:Unattended Purchase Order PDF.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:367'104 bytes
First seen:2020-08-20 13:17:16 UTC
Last seen:2020-08-20 13:38:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 6144:klUtDMcOY2CcOtp8k1lLuX2ItmGC9GkgOEFJLsKeiVnHwFIRXVZORxgVVZg2vNhp:kYMcOCTrzmmjQkgLLsKe6QyRXSgVjgaL
Threatray 2'241 similar samples on MalwareBazaar
TLSH 7074120713786F21F67AD3F04332281683F7266A6563F68DADC935DE2439B454A22F93
Reporter cocaman
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/49150/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.405.15644.3440.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/441600
Signature
Antivirus / Scanner detection for submitted sample
Benign windows process drops PE files
Detected FormBook malware
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 273464 Sample: Unattended Purchase Order PDF.exe Startdate: 21/08/2020 Architecture: WINDOWS Score: 100 51 Malicious sample detected (through community Yara rule) 2->51 53 Antivirus / Scanner detection for submitted sample 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 7 other signatures 2->57 10 Unattended Purchase Order PDF.exe 3 2->10         started        process3 file4 43 C:\...\Unattended Purchase Order PDF.exe.log, ASCII 10->43 dropped 13 RegSvcs.exe 10->13         started        process5 signatures6 71 Modifies the context of a thread in another process (thread injection) 13->71 73 Maps a DLL or memory area into another process 13->73 75 Sample uses process hollowing technique 13->75 77 2 other signatures 13->77 16 explorer.exe 3 6 13->16 injected process7 dnsIp8 45 www.funpexw.com 63.250.45.230, 49758, 80 NAMECHEAP-NETUS United States 16->45 47 www.patadeouro.com 16->47 49 2 other IPs or domains 16->49 37 C:\Users\user\AppData\...\fnu8ijpph6ql.exe, PE32 16->37 dropped 59 System process connects to network (likely due to code injection or exploit) 16->59 61 Benign windows process drops PE files 16->61 21 control.exe 1 17 16->21         started        25 fnu8ijpph6ql.exe 2 16->25         started        27 fnu8ijpph6ql.exe 1 16->27         started        file9 signatures10 process11 file12 39 C:\Users\user\AppData\...\34Plogrv.ini, data 21->39 dropped 41 C:\Users\user\AppData\...\34Plogri.ini, data 21->41 dropped 63 Detected FormBook malware 21->63 65 Tries to steal Mail credentials (via file access) 21->65 67 Tries to harvest and steal browser information (history, passwords, etc) 21->67 69 3 other signatures 21->69 29 cmd.exe 1 21->29         started        31 conhost.exe 25->31         started        33 conhost.exe 27->33         started        signatures13 process14 process15 35 conhost.exe 29->35         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f3a30108ab40b7f31ad7ad191bb41bd3ad148d09597705c1ec0bc0352d18c29e/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-20 08:33:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6orqccflic37ggwxvumrxna32owrjdijlf3qlqpmbpadkliyykpa._file
Verdict:
malicious
Similar samples:
442452b82edb2b18431c296669c78df1c88b210775e9a9b5d7726a1092a8fc6f
Formbook
66a51591c6b5e01a8aa9f8db61e81d2508b3a6535d7c7a53c501f35093b28fa4
Formbook
6ff25388a91cbed0a11467e592e39e34c54de49d61876a2a201554e67c5b8cb4
Formbook
7bee02185a682294214d68a1c41ed3e0ebc53b275b200fd8b4a03fc92e1c463a
Formbook
854146ab0835f912d31018649e0f97ebde7a2267ec1085a36bc0dc73f5b6f2a9
Formbook
8fa9dd16bb791bea50566208c8b216acc3c41e5c65495f34c3dcf99c595fccc8
Formbook
d6cfa16240c572c1d310d0e3f9a3a48254103dbfdaf47d08b31bd255a6022d50
Formbook
db31ede125999d44d9c886d76eb8d5c5ee280f17130e3e3138bf1f76935d1b99
Formbook
dda62be10b5d6c904c056f244d721e7dfc5bd60d033992a4763fb1105e0c334f
Formbook
ec34c3db0d2c865486e52760c0d35dab95adcb3544f2e03f5023495d112d64ba
Formbook
+ 2'231 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/200820-chwsletrde/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.funpexw.com/kdz/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f3a30108ab40b7f31ad7ad191bb41bd3ad148d09597705c1ec0bc0352d18c29e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 97fcd78356f44eded027f8236c70a7d8923b1f9390ee2cf87ea220e38c2b8903

Formbook

Executable exe f3a30108ab40b7f31ad7ad191bb41bd3ad148d09597705c1ec0bc0352d18c29e

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 97fcd78356f44eded027f8236c70a7d8923b1f9390ee2cf87ea220e38c2b8903
Cape
Cape
https://www.capesandbox.com/analysis/49150/

Comments