MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f93a11630922fd15cbee49f2d7b94a2e9ba7805c333ec30088b46435455027d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f93a11630922fd15cbee49f2d7b94a2e9ba7805c333ec30088b46435455027d5
SHA3-384 hash: d8ffd273662de5c133ca44b31a3bf44a370778443859cd260e064dd948579323e5918d41c007606f42e4785c92fc1973
SHA1 hash: 492b05c61acd0c83a9bf342cb30e93dec40b09d9
MD5 hash: 9a72429d29810f5def1c843c98b5b9e8
humanhash: king-mountain-cup-mike
File name:demande de devis.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:424'584 bytes
First seen:2023-09-08 19:47:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 431 x GuLoader)
ssdeep 6144:/Ya6pp4fjw/o7fKMr1u5YmJpCLMrBdb7qO+NXDmIYVapmd0zTeqf:/YzqjuoDKGu5pJprdbCVDSVaQuXek
Threatray 27 similar samples on MalwareBazaar
TLSH T15B942310FF55E0B3D5F34A335D752B25EB7DBA620D49028797A4EFD93BA0680460DB0A
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
315
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
demande de devis.exe
Verdict:
Malicious activity
Analysis date:
2023-09-08 19:47:32 UTC
Tags:
formbook xloader stealer spyware
Link:
https://app.any.run/tasks/a736e9e6-cd3d-4a62-9016-dc6a06d54a68

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/447589/
Detection(s):
SecuriteInfo.com.Trojan.Loader.1550.12376.24654.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Launching a process
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control lokibot lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/64fb7a73f31091fe114a1448/reports/cb4b862f-2cdd-46bd-8938-a7d3847a8af8/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/f93a11630922fd15cbee49f2d7b94a2e9ba7805c333ec30088b46435455027d5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fb6d7e56-97b3-418e-8bbb-69a92b11a228
Result
Threat name:
FormBook, NSISDropper
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1306476
Signature
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Queues an APC in another process (thread injection)
Yara detected FormBook
Yara detected NSISDropper
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f93a11630922fd15cbee49f2d7b94a2e9ba7805c333ec30088b46435455027d5/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-09-07 10:27:51 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
27 of 38 (71.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7e5bcyyjel6rls7ojhznpokkf2n2pac4gm7mgaeiwrsdkrkqe7kq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1706f846eef66c0ced9bda22b412a48c9f7aa026d13c7173d2687fd8629f6a27
Formbook
21f03aa3cb1ce12b742fc78552681e20099f77f1aa347516a253e383eb5f3f11
Formbook
3adb8aeb7691dc238ebd6c61ae7a0f7bdac303f547d02109d5d23bf096403733
Formbook
63b59f1390003e44ffbd4460d2b6811586b1aaaf155a64186397002160b370c6
Formbook
690fc14f8b0395e7390646c6832d462bd421bc7caa1caa5f66654b7252a0e102
Formbook
9ffa96e46faf0575d49897cf2babb92f611980b60b539483d162cda6ddc19057
Formbook
a3ac1a13b363264a45374dbc9a485e19f80d71cefa4f3cb72a902d46c667330a
Formbook
bdb41289aeeae3103dae4fa81bdaebb88311bcc6127b1c8c1a9afc96623adbbc
Formbook
d1fb7e74ddc8117a5eb3c57b607ac4eee92c9d67a8138fcb12c4d4995ef8109a
Formbook
d44232f2022c8c9e948b4fc026cc391959c2e662a152b77e95dede5989320c27
Formbook
+ 17 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230908-yh35bsfb6v/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
ba8739824484e070b0892ef96c891ca58ef87e42f1954ee173e1dd998e9bf690
MD5 hash:
97be8c2f6b17aeaee1cd75d326ee69c5
SHA1 hash:
1208db7b74c61c649cab726db79e29832fbd6f6e
Link:
https://www.unpac.me/results/d7409410-f6f3-4920-a29a-131ef4d1622b/
SH256 hash:
13e982225c8c2c3a496943c893f68f5df437a2fec9a1709648ecb57f99c1bd3f
MD5 hash:
321411be635881997a6db96db04f9b87
SHA1 hash:
cba61a1b3b25bd8d7e5520ae2b81889702ef07b1
Link:
https://www.unpac.me/results/d7409410-f6f3-4920-a29a-131ef4d1622b/
SH256 hash:
f93a11630922fd15cbee49f2d7b94a2e9ba7805c333ec30088b46435455027d5
MD5 hash:
9a72429d29810f5def1c843c98b5b9e8
SHA1 hash:
492b05c61acd0c83a9bf342cb30e93dec40b09d9
Link:
https://www.unpac.me/results/d7409410-f6f3-4920-a29a-131ef4d1622b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f93a11630922/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f93a11630922fd15cbee49f2d7b94a2e9ba7805c333ec30088b46435455027d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe f93a11630922fd15cbee49f2d7b94a2e9ba7805c333ec30088b46435455027d5

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/447589/

Comments