MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6445ad9735732aa3ae46b05eeb7707cca1aa4e0fa4ad72e64de3d1c467d5121. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6445ad9735732aa3ae46b05eeb7707cca1aa4e0fa4ad72e64de3d1c467d5121
SHA3-384 hash: 7b53bd523a53a842318217d0e31707d958968120f4934e190174fbe24e9fe3b01f577357930f32488ffe047dd128940f
SHA1 hash: a47fd46af29ddf67fe12d3abadb651c3406778cd
MD5 hash: 42129868bf93863f0f6ae5cbefbead0c
humanhash: mississippi-uncle-texas-spaghetti
File name:e-dekont-20250624-0.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:833'024 bytes
First seen:2025-06-25 07:03:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 24576:3JFkJsOmPyiLVLhDMDxcmsnB0VsAYit/r5Sr:oabnLVLYxcmsnB0eA9x
TLSH T1C905DF943FB4AEC1D9650BF10621EAF812B8AF9A1C24D39A7DDCBFDB7438B405454293
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 344bc4e06968300c (4 x AgentTesla, 4 x Formbook, 2 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe FormBook geo TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
350
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
rl_f6445ad9735732aa3ae46b05eeb7707cca1aa4e0fa4ad72e64de3d1c467d5121
Verdict:
No threats detected
Analysis date:
2025-06-25 07:15:02 UTC
Tags:
netreactor
Link:
https://app.any.run/tasks/08b106cb-e323-4c23-ab3b-21acdd217265

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/11026/
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=685b9f83b06783b9ebd73582
Tags:
micro spawn shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
entropy obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/685ba02875f34c229e65a4f0/reports/532ee74c-9c31-4547-a722-fd20608abe1f/overview
Verdict:
Malicious
Labled as:
Genie.8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/f6445ad9735732aa3ae46b05eeb7707cca1aa4e0fa4ad72e64de3d1c467d5121
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/49aad654-0a01-4016-8904-de7bd9b2625e
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1722456
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1722456 Sample: e-dekont-20250624-0.exe Startdate: 25/06/2025 Architecture: WINDOWS Score: 100 40 www.talkartifacts.xyz 2->40 42 www.eostech.xyz 2->42 44 3 other IPs or domains 2->44 50 Suricata IDS alerts for network traffic 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 Yara detected FormBook 2->54 58 4 other signatures 2->58 11 e-dekont-20250624-0.exe 4 2->11         started        signatures3 56 Performs DNS queries to domains with low reputation 42->56 process4 file5 38 C:\Users\user\...\e-dekont-20250624-0.exe.log, ASCII 11->38 dropped 68 Adds a directory exclusion to Windows Defender 11->68 70 Injects a PE file into a foreign processes 11->70 15 e-dekont-20250624-0.exe 11->15         started        18 powershell.exe 23 11->18         started        signatures6 process7 signatures8 72 Maps a DLL or memory area into another process 15->72 20 8yWXvV0KGTZJ7S.exe 15->20 injected 74 Loading BitLocker PowerShell Module 18->74 22 conhost.exe 18->22         started        24 WmiPrvSE.exe 18->24         started        process9 process10 26 msra.exe 13 20->26         started        signatures11 60 Tries to steal Mail credentials (via file / registry access) 26->60 62 Tries to harvest and steal browser information (history, passwords, etc) 26->62 64 Modifies the context of a thread in another process (thread injection) 26->64 66 3 other signatures 26->66 29 3yRVDHeKMWxGav.exe 26->29 injected 32 chrome.exe 26->32         started        34 firefox.exe 26->34         started        process12 dnsIp13 46 rampagewargames.net 3.33.130.190, 49700, 49701, 49702 AMAZONEXPANSIONGB United States 29->46 48 www.eostech.xyz 13.248.169.48, 49695, 49696, 49697 AMAZON-02US United States 29->48 36 WerFault.exe 4 32->36         started        process14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f6445ad9735732aa3ae46b05eeb7707cca1aa4e0fa4ad72e64de3d1c467d5121
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable PE (Portable Executable) Win 32 Exe x86
Link:
https://app.malva.re/file/42129868bf93863f0f6ae5cbefbead0c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f6445ad9735732aa3ae46b05eeb7707cca1aa4e0fa4ad72e64de3d1c467d5121/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-06-25 04:48:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
27 of 38 (71.05%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6zcfvwltk4zkuoxenmc65n3qptfbvjha7jfnolte3y6ryrt5keqq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/250625-hw97sstsdt/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/bac1f4ee-1b9a-4532-af44-4632b032531c
Unpacked files
SH256 hash:
f6445ad9735732aa3ae46b05eeb7707cca1aa4e0fa4ad72e64de3d1c467d5121
MD5 hash:
42129868bf93863f0f6ae5cbefbead0c
SHA1 hash:
a47fd46af29ddf67fe12d3abadb651c3406778cd
Link:
https://www.unpac.me/results/76e14dd4-1571-4198-81cf-cf1d2d0c7cce/
SH256 hash:
fa3889846854ef037c9e350a7274d50fae8c2ff11e91ce1e06453cd351967119
MD5 hash:
9d7041814acba87c294b1abcfadea481
SHA1 hash:
53bc6f748ae5c851d23b6ab8635d38fb9eeaf58c
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/76e14dd4-1571-4198-81cf-cf1d2d0c7cce/
Parent samples :
a6cc6e17a43fd18e44449df2bee44d53d4098817149e1d443a61777cf458611f
d6a676ac2fedead7999ed8250543e38da6096cc6efd3c7517d49d6b090ffbec2
1fca7f3155e24ba3e96508a8b406395c80966cc7aa5f0ff9e6201f7979c80b8b
dfb8ecbf4f52efbf20605c2be946d62bb062edf1dce896a9b45516c7aa90e422
797f44aa209382a598bf62263d36a65d3c0b238c6e056ac1df84dd989d79ff03
7d6248b79e83e710efc263a60b855854648088ea196e3460aece7f3fef4dbc8c
841a3a3d4807c215f922e72b1391e8c56db813173a248ce4e5e7b29b5534b5ec
b1f950d68fb3e445f741d2bb7fefbcfe1b1a756548dcc6f88b173cae77495b57
0195c54fa21dd3d6ba8e59245bfe3953c0b56a05f53f877654a634a5bf088a86
fe8abf598767162b0eb16dcf51205afcfd221eb2b2f23f32e5b286de19561df8
0c7252f921ef57eac052095ee10c5553c98f123d2f7484d795179c19689df5d6
f8e5a47c68fac52c69ec3fd461cde2ff76d64fda08c528c066a0ab822485cd23
5abfe96f31b8b8e4013501cbd3e7bb332e03b37e96f04cb75f05c04f15bb66ac
e09c5d8ea6eb4b7eac7c73e951e3e43d95a62a94fa053fdb4ef64da70fd76361
04a80cbfdbc1428ea6a1b6377bdd9d164163abf0ac1460e59db8862cdc322382
4cd5676a9e5f1f59e10c246d9a6c674518e66031fea5e17d23318ece2c5e9c67
ff14655342e9f2d6c62955f89111bded7e4d1f65237201e502fb9b7fbd75c46b
4a6dcfe4dfe7d02d44962cb9e47d87d6d755d0a9481a8013b145eb674ba567a0
a25bab1b3a0b9ff47c05a477831e3c14ba6b3b9b60a1a7d339595b8c5243313a
cdf8c43cdca0aae5ebae3ae4155f8ec78d84eec31e864c0cc843b99c61d36c1d
20331b45b686e183cb628218e6fe464eb1e7e2f56ea9336e7dd3ec067d194226
4fb637c4caacb8d3ea6a9db3b0d06cc8a9b5b0f23429dab7d0697053a55aa0dc
a497dbe34f12783111bc413a4447e581e48e5c539f8325ce95fc71800f1e4c43
e89363fb758ac1d01dffca3212cd980aa3fe199efda522052fc8c3e041b31f70
de9c905c7d05ee8775d644ecc9354ca87a1c74fe5eb23537c0bec8784e7dfaaa
b456078d0dff3c375378480fb133a340d88ae4b59d6598ead4249d66523f3428
4bc3ba71f56e14ee1e7eb8f6fea0fbda1a9aa92545205097476853d0308ad623
f47b7f935ea1bfb7dab5c9e31e368aeb7a07fe506a4cf430c36b9a3cbe8ddcc3
d24f280b413e7e170bdc29ba7bfaa7a3d221e582204c331803a9fbba64ff7d13
bb6f0186eec1d2587ecd2b6b0e0c88c8189823fc633c56848365b362dc3f53de
44bcdcc19976200147601f72c903a84f73d79a82782af77a5e4da96b791fce73
3144e19689bfa00782be4602c85cb949b03262fc1da9c2ea1e765258668b61ba
e5d18d2a845b927f1f7d7f7e33031a20a3d6b540e2b00f3c064255ab3948e7f0
c8b76fc09a283dae6e7ed2f6cae8e31d0b4038abf3f851da15672110b99fd23e
698e5418168e5500b644766ea8c31cfc826ec6399c1f61cf85481caa3c183a65
638c6eea32c710305fe44d62be21b6ab68a957e8a07a487b2501d82bb2419f1e
e61db8e0b03e566917d24767e2146e6335f4dacfd1b1a8cda8a49de6e0544a19
f700199315360a824ed6eca65f543d531d04210118e3cfc8bfbe986ed1641aaa
0f421725abfeb6485909289412de00d17fafa7f2f13b4f6e439f9aaf637c2470
cc5401e45d7f9f7e2ed916b1ecf9acef960d221e4512ba7f465bde7b56b57834
fae7e35584a2df9dffeab985c2b6128609a35ff7eb7d994b6295e8a3bb5817ed
f9c3b78cce61d4ef1c118287edc5d5d3324bd64df1d2c704c087e7b073d7eb33
0ca32ef99b452e03e0a45dc234399bc6a8588ed4eabdce7afacce73f3c20aaa6
ffc12a905f90d00b9381e8e3226adaf6c25e3deabab70580a46f39eb1e68deef
a0a646a7539bcf09db1f8d40395bf5b5c1ae885e808e512bbb4b898a4495c079
87fb77ed68ec8001ca8f1dcd4be4bba3dea657778223ced143964dfac2239f52
090be2d28dbb7a3d5782f1946ca17e5c048987dd027090cf1de7b8cffc0c07ea
0f99bf966f34d5152ee51fd8510a37b3fc0792334c9b8f2475e896bc2ec72a6e
89a08615e8a94f42744b85d9486cefafd9defa24951b8d69f0c8aadb082f2487
1cdb6733c402bb21c71997839d008b94e69097f3156e69bad3dd7c252cf042e7
97719ce27cd8169ca0f4db352c3f9c53fd700c55d059e9835fbd451e75f59bb6
da00184567031f30767dae698ef809f2faa6ce271b03a4e03695f0b236e68d1d
e4b8f8770eb2fe1a6aefd4ac5087a04e1034bb5ab320a200b8d4e3279f835597
9247f2f45db631dd50e32455deecd8bc32a05cea40bfcb4c3f3b9ebb0732eafd
19d152d22b4b9d39d05e579b9fe7c48060ad4f2c2786da3dd3d497197ec3c7ad
bace7360ffdfb5ba55798cf7c08452ea943877d49de2f135956ff0eb0e0da98c
0228c928cdc2312658629a75d65bb333014b28585f6b5614db51b86e7189a234
90c39e2981ae3de1f04f0e946d0c50271e718cd853eed6333e67964c78a25465
d29651c63ccaf0392b12fe7d501cf7072878a1d5bdf77cd98d9ce7c53c98d907
2f835a2d633b2fb81fb9375cefc17313e59a283de5869b7d7f04b42e9134cf25
0e6389a3fdfa62ca6e1b852be32912ccc7152011c3de3bb12bcca515109b3f38
e82761150effc8a77c096328b3fe325dd7910104f9d756a56868653e3c813dc6
56dd5e30024791d0240babaf7110454704ecaa0936bdde1c7a3e626b89a6c7cb
26d88548fb6387644d90e615eca6e1f0103ffc5df0b4de341c81cbdc28d53ce1
bdf389c57bb92746de7ea48eff0df48bbb66bccc9e451e632b7ed76398ab7e0b
3f41083e15aa4dc793017ee919805df5132743988a31cca59099d5a8842f4186
a04a0223a2cb079868f34225df1953d8897690ef0fd730f2d83a8dfa9515d874
3a8d95ebd1a116107405f1cb2a7d42e954643a9a0244ceef22a70b656b8525a3
6fa16359905843e294d5f805986bda12aa603775ea7db1eaf10beff3493c3b93
1494ed37c7ea409a0d8445032855474030fc4dbe0c16844b3b349d55acea5de8
f6445ad9735732aa3ae46b05eeb7707cca1aa4e0fa4ad72e64de3d1c467d5121
bf166be918695404ec2724b62671d7eac13fd67e39433894439d70a2ce534861
a3bbb335406677c373dc6f68ce37705ef3e419439378ef2b58f93302914e0e3b
7e855c3d24b8bdd605c526a0d007d88b90c76c9b9b1ae837d48db2c987f75765
93e14efc8eadf9f9dd7d4aae3b8d680e22ad771d94caa155cd2ee774b3712a3a
8be521d630b1c7285e4e2074443ba82175636714302b975bd27da3e0cb6fc270
6924363cb427ecd59994781e876040d4f0f2422fec9b0e1f61dbe9000dee2baa
5f192f10cc75f3be973d6f3725fb0479f70f67fbb3412f9900a272730acf17b3
1d9b47e8366507c23d81a11dfbc4f5e54c95f6a4b778da0c5990feb28751bdae
5f16ee8e5457480d3780ec03b7b37d9a43f0621a4e8bc0bea6fe77695f6e1ea3
0f546fee6a66dd05082402fcf23e426d2b5bd8a97f6544b77ad951e1f65689bd
7412c73049ad87dbfc8106ce0fc8a03ca2a21d6507fcdb53d96fb2efb8ac1561
4ff0882b1dfe25c7b1793da9754485d1f1a28e660934e8fec5b7aad2e5571502
8f503c7fdf82f233c787200e9672d93ff653affadc78fd3549a477650f4aec36
ff67a4429b3cd257a8ef58dbbc90450eda82271ef4256ba1dc5fa6eb215fedec
86c422aeea528f860b82e8af539b3d38f4c06b1f574addcc0afb200972c51473
140e2bbb3ae25648d8993155ca60f6dac9369dc41ad2eb4fa87cf6104ab938e0
e4408864dff2496aee90aaad03699d107a62e047c19da2f396c3e4a5e1e18692
d20f814c949d8aaefbb38fd7fc5a3d51358e209c88bb40ed611ab34802e3fd9b
9cd9d15f66f824f3df89cb5fd98a32e768a31dd3e0d05245d15759be6b88129f
2f0ae3872ddb72b9c17060aa7608559a5cd92d376dfc88441ff8c54e6f1a65dc
b9634112c7c3ee5da40fdc31fb9a1f4c05dc0c432945575f869d3566c74c4c0b
a14bc89b9c0e1ef9160cc2dbd223eda8627b4919d616a2668e93f9dea8334246
033c55f8f206bede32c03f77eede842650727506dfad0be0aea118b79f9dd922
068035d7c009e6fec1d2baaad409c8289f1c1bba84c1ba792efe5f963db3f97e
b310dcdd9e68c3f72ef76ef1f10506a3094e1de2f96564276d0f7dc8d11bf5f1
8038e254a1dfdbe9a67358318bbe1f90f935b97d9eb6d87717101ff93224884a
e4c4cd20f12ca28fcf603d531dfb0dd6cd0e0222d5187d0e7227d33854776050
6efe9fbfc3d3e47786a8ae76434966a1c64f7c4e91d8709c4eb36ae7b6bb0a86
e2263780bc74e9300528646a608133f1b123def3ceb62d09c5086f32ae813e82
10ef58d9ab1de0c837b94cf2c65618936c9ec98c476f9b262e0c33c0fd752112
2ba48ba616ce16bf1a7b6d8dfbb09f1c984a4c27b11d12b26531992dd4373f23
7c3204c01bd91defa73bf48c8537104084583572061a3f81081aec3275741535
b974f6e408fee02342f4cc5fbc1580da54c4fbbdb3c7541f8cd0cc7aeb097df7
9e3ec9a0a7c86125bceea9ddc46cc00ad70476b0182da370ee8358fcf543939c
ef31e67b0e3fde58acd72fd5e0c6939b82935df5e683e94042239f834d6a2936
5e6b39d039f9fc05c0262c84b33cdfe703b70df0be1491cb2afa294d344756fd
62bd1a4886eaea5b5bbd21eea90540913b0a7a573305b0eb7c58cc61e93ecea0
76c83209bd8b50457ba60e433a6a49be1f03471d506906ee18b8b211fd0779dd
27da76240b4d9ff64b74ed54b40950861096cb90098a81262051704b63aa9096
a0f8fddf5306250fb6d1a880798c989ba07fe83ce09c8aa82c7c968d840ad243
372210f4c6442c3236ed1b7dde082f60d169afc634d13e6953a86230e4fc06d2
88d0ec8c33ccb203a5312e45ae8674fd2f555de075e9a1fbbab1905bed51c1d9
e3ab15a37eb0ac7fc858be0a57d6ca34de07545ec156cab774114a031c72ab4e
a86e9373657effff617182f3bccd52a5e6013e635ca40357d468871f38fdaa8b
7d5e8db5ceb4205a26d726a6375394528dd1ccb55084f337ac69cdd3b0bff6ae
3b6585b5a221372d1ea06544e7762ee242a7790c0f6dccd4905b48af00b45558
d496059f895bbd1ec2bb25f7f4c0395210d085bc525b013c2fe3d962d5e76a48
95d237db17e891b78afc8df935075fa973a0823158a6b706be8695f8525775b3
74ca5aad35d138c31e8cc8bf3a0d3389ab321fac99483f475fa434a6ffd8a6a4
82dbec85d38c90b698f12ae23f185b3f5a76b15b0f544530ddb9750c8fb80d6f
a6ab3643364fe7f07cdde83e146d477a37ed88618cb0278cb5d030ca3f226759
767aa72294b73ffbe525ee35fccfd5939a9cf6d1128717ac159ee9b9f9adc759
8ed52e5cadcf8bc30a3e25bb135c0d5e4e81c8fd43ee2843736bc614998e9a34
8dfdf9c7b2657d5f27838a2ee023e77497bc31e87853983974db402852a28ebc
9a80aacb95033e97acd1faeb405e0bf54e3e891cc8963244c2036ff63630ea10
888e3ee78f9d77ebe995ee5cd3aaaf1b0c6f1c62e5349fb2666cc8ca8c095c7e
2ba41f387ea8d91674878017056d8653151a1c2bc45b4d4c4d97c83657b01db6
34df432fffd0dff5f4a974f12dd75d405816892e113100f34ed1b3bac7358ffe
3361b8e7bb64b56a082e777887264cc89d4694640bc53e1f44f86efed13e2108
d592e061c641ef816a8dc1a6d83d36578a84df47f3b063c06299c8debc4b8a21
be09dbae32fa67700c6ebefff7f8e081b61efd7431cc7326093703a172f91530
bce8d98eb5c366ef1c2bfe0d513e1e59230162943f5fae377a3f1cdb767fe3f6
90fc5b8abe7025184179b0ecce4948baed241898ae625f3710ccc1cd92bcdc00
49ca026d8d0b9af34ff8daeca673475a84d249fba5c6a8204b8f9a15c0145820
451202f7640bc0ba50330e90b7d4496707f2bedbd851cc8be2a7a38dc91ebc1c
2032e1262f598729cad41b1ada73fbbbcec199ee877c825583650c65a824210b
9c6a17b9f0909eb2b0feebbf337d3bd8d543a7e8c9344242382bf814b6fb614d
e70d76f8e2e25aac085a95feb18cbb6283da2ca8b7b65d383723cceb84eff706
38a4d9f237a7a43c30064b9013215249ba0245abeb39428eadb28d120a7e0087
d0d7734635bf2c12c9a6c714ac512d11ef03e4f00a3ecd19cc666653436c652f
8b83d463c4ddfc873ac4954f326d473cd6aa3443617fdba8860680188500def6
1d8b3cef330d50251ae4a59b3cc24e341cc38fffb03f3ea0731ceade94ab71d2
69b4c8361199937a0cb7e28c689e3dfa2967af5dc5ed0c1fccd770273cc3c71a
2037288b15790f8046e536194e8e2cd78f1cec0af33e2368436368475b2c37f2
5430d9faf55e36dfc17034194780f1abbad5f5670f63ac3c1870da3352e2f342
ec7615c1c9aa8d049dd4c8f86407d3253b30137a88e711eccd2e26e017dee00f
7f44edb791af09f8161a6b292d6fc82cf3601e56e1996228133081914a660d50
84f2e7778e3a25f2b9900ddfdfce6bbc39a6814f791c44100fd7d35d38dd95af
0f9f93ac54a96bbbd431fde1eb4bc5499e94286e8234f396d64d0b5e6f5394e2
5902a20f794b3c5ed37a3d76eeaa2f4a8be1548d83f9a94026986813ac5ddaed
1431c6a53d3d523daf93f328d21e164db1457b7499b0db9da818325bea6cd277
de95c7fdb27d4768c98e3ab9230019ae3ab2f2d54890778c839e6f7be10e2bee
567961fe8882128ade4c226651ee188e05fdd8927daacea3ca1a2c487d049dba
890a5d662df8f575eb47d331395eacb582e888494ebea7edd10a9374b605b937
a97ce603c002e36fe4dacfa2df5f77756b7fa2e827c934152ba1acbbdcd6675e
3fa202fb6f5dbcfd3faa63fea105e530440204fd747ba386b9a290545453d4d8
57fd4666f5ee7b31e8b02f6c31d0a33bb08f5eb1694a759b0b1aa95ec9fc0524
df71af12f27e4f7512bc1ce4b7765e550b30a1887fef2e0781770c2c840d262e
22bfdf4ec2732b1eeb75d671dfb2b417f64242b9f30e366c1207cff835a3e175
6abd3a82fe2451100cf201fe9669462ba805b4ce1e754cfb779083592b24bcc1
3f992a10ab5d213b5cad26ba4f416c1e5c54b386d1c20c8a2f4ccd20c5b40e24
fd9203e74edff64b5059ed50dc2bab90592a5bff46a84efd9a7c2f3735509952
e8792948e135a95560f471d83d37df68f63452ac67f33b643e7a1ecea4f04c6a
b24151a525eefa5dcd9b083bc51b383ee8fd51c8b5dd59ab6743b39209196dfb
1c237d4ca5bed7db9150b849ea06db16f44218003ac9649e412746bf6af9ab4a
8a3c4a4dedc8ccc8dcd27b9bb2b0f2a3982b938cf9185c0c4c5b8a46a8321002
47c1e1964a4887a5cbdbe07724152dce1fc0d4f1a81466fb7349a02a8c0de8b8
2954300a43acc2d8c0fa950282160984746ac1d5a7606be99e2c87d03dfec961
SH256 hash:
8e1dd83d9c8f1b6614e37dabc71608d8fc83762b6a7083f7176fd4e43805fcfa
MD5 hash:
8860b681c393cba411653f72000cbc13
SHA1 hash:
72d81543d1bd15459db72f41ce5c0c3757d4ec98
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/76e14dd4-1571-4198-81cf-cf1d2d0c7cce/
SH256 hash:
fae90ccbb6f6fafa775c9643e8b9c5d17720d62f20245a547fbec305e58ccacc
MD5 hash:
610afcdfd567b3a6a35bdf2a239f4f00
SHA1 hash:
81b28200866e2ee852444591721177129e012b18
Link:
https://www.unpac.me/results/76e14dd4-1571-4198-81cf-cf1d2d0c7cce/
SH256 hash:
53056a25dd652fd112bca57a29c528bea36a92504643549278af08bbe34a80e3
MD5 hash:
b2a5fe56e7429d9d3c7df25f9cc341e2
SHA1 hash:
10abd0e12c10c9591b428ef4842fb67ac41184ee
Link:
https://www.unpac.me/results/76e14dd4-1571-4198-81cf-cf1d2d0c7cce/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f6445ad97357/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/11026/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments