MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f508b66b3b6398f2a4d73ecfd057ab0804320d523e09feefbe59ee33b1124508. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 12
| SHA256 hash: | f508b66b3b6398f2a4d73ecfd057ab0804320d523e09feefbe59ee33b1124508 |
|---|---|
| SHA3-384 hash: | dd9a1a555adf65abc28c794dd8b006d16282dd11994db5455e7d677ba0b3d91a267b09fc3903e041539491a6a19d68e7 |
| SHA1 hash: | 93226e6b5d30791551a78ef15f163e5e60841ba8 |
| MD5 hash: | d45bc7f5317766ac78d045779f63ccec |
| humanhash: | batman-oranges-freddie-steak |
| File name: | SecuriteInfo.com.Heur.22835.17503 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 643'072 bytes |
| First seen: | 2023-04-23 09:31:15 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:zCg5Btce5eYr9FKHZaLjwc3csngNa9G2paip:rBtFUCFKHZ+ssng0X |
| Threatray | 2'635 similar samples on MalwareBazaar |
| TLSH | T1C6D4F124711E79B7E69AA5F3524A37933B6C32CA3D3EB2646F5D84D4274738E0F80846 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | 3571413931695171 (5 x Formbook) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
306
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Heur.22835.17503
Verdict:
Suspicious activity
Analysis date:
2023-04-23 09:32:59 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj
Score:
68 / 100
Signature
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Leonem
Status:
Malicious
First seen:
2023-04-23 06:55:48 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
18 of 24 (75.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'625 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
f2573c10900aa29d0092b563a58ec946566ac005cbcfaefe9d293ad70511c3d9
MD5 hash:
e5f965f9fd22956556c3bb09fa6aba10
SHA1 hash:
8630f85561dbe446604704b4469d669f96edfd8f
Detections:
win_formbook_w0
win_formbook_auto
win_formbook_g0
SH256 hash:
5bf082285db878674889c745705747b6baa2e2780b9c6562877aaf62d3faf99f
MD5 hash:
e5dfd73907860d46379d7b5080a11d38
SHA1 hash:
f70fe8895457dd33762677dd488a1bae43cbbb4c
SH256 hash:
dba75b338935391435e0f54277b7dbf4c39d8e67e897fcb6c17d910c0577170c
MD5 hash:
464702ec1a43963f7506b2a93862811a
SHA1 hash:
5cb7518895a496d5bd48598146aab06338c754a8
SH256 hash:
12cea1f9725d66d40c559e321891405e7b10dc555a80b55862e743d11c2f1e59
MD5 hash:
191d6f5623722755db2f1b6ca1640b2c
SHA1 hash:
d8308c92d39140dc843694a7c160afe037bc7606
SH256 hash:
e5518e76f14e87bcc58a705c6f8f3a686cbffefc0e55985d17a067adfddf3688
MD5 hash:
920a2854e9c183ad2ef7d5543c296d38
SHA1 hash:
2c20da753bdf6f1a46261e2c132dd42f75c94229
SH256 hash:
7b0b34e3e8fe8697d11af019ce819730f6d5e28536c06da52dc3478e562dec1e
MD5 hash:
d116914c74f90995995968f68e22f026
SHA1 hash:
191ed40307e81064260d40eeb4b3baaac23c0c8c
SH256 hash:
fe94b240f3d8b6aefd55a35e99169e55bc2b69f352dd32706a07c67c42554cb8
MD5 hash:
ed6c156cde97234e9183168b2dd26bae
SHA1 hash:
ee17e1cea45787013989537b46ecee4d43c640d0
SH256 hash:
f508b66b3b6398f2a4d73ecfd057ab0804320d523e09feefbe59ee33b1124508
MD5 hash:
d45bc7f5317766ac78d045779f63ccec
SHA1 hash:
93226e6b5d30791551a78ef15f163e5e60841ba8
Malware family:
XLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | BitcoinAddress |
|---|---|
| Author: | Didier Stevens (@DidierStevens) |
| Description: | Contains a valid Bitcoin address |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.