MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe4e13f02beb71ea121b69523b04815d53a82de51a7202239c30921fa00817e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe4e13f02beb71ea121b69523b04815d53a82de51a7202239c30921fa00817e9
SHA3-384 hash: 3d73b1dd45d321307f6d2eb0c099e014de020830aace1ddd07b59b4499c9f2d1fefab6a689195b5847af2a7f05210d61
SHA1 hash: 09a01ffc5edde48161366aa404d818581765464a
MD5 hash: a2b24c3f209b2890a7d1178a2021f71d
humanhash: arizona-speaker-lion-lemon
File name:fe4e13f02beb71ea121b69523b04815d53a82de51a7202239c30921fa00817e9
Download: download sample
Signature Formbook
Create hunting rule
File size:212'992 bytes
First seen:2023-08-14 08:02:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:AhH4reK+vNRs/1o5fKhgFox5Oz70NaZyCoaf4A9ixXpOKwaOVgapSV8p1cdRU7E:QgeK+vsNowhsoLyvZD/4A9EXy40Sq
Threatray 3'556 similar samples on MalwareBazaar
TLSH T1EF2412B5789BC453DA7E81FA950B3BEB1B0DAD93650143E639462E4832B402C973D7B3
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
278
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
fe4e13f02beb71ea121b69523b04815d53a82de51a7202239c30921fa00817e9
Verdict:
No threats detected
Analysis date:
2023-08-14 08:07:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2893a223-5e4b-47ff-8cc8-21d539ef3024

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/442615/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/fe4e13f02beb71ea121b69523b04815d53a82de51a7202239c30921fa00817e9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ef90f659-d241-456b-9996-87d32b309827
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1290859
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fe4e13f02beb71ea121b69523b04815d53a82de51a7202239c30921fa00817e9/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-08-14 08:03:07 UTC
File Type:
PE (Exe)
AV detection:
19 of 23 (82.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7zhbh4bl5ny6ueq3nfjdwbeblvj2qlpfdjzaei44gcjb7iaic7uq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
07843e27993206a92d9e0bfbb249332fcfedad068bec8f7f7f3f318654c7910c
Formbook
2ad988ae3330dd6c7886c279f60cc22ab08ba3343e556a2a91ef3a5608383525
Formbook
2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644
Formbook
3da9fb7836eba199f838a991f8b25e1c5930572a0b3b1935c4d9342020986093
Formbook
6769905302dd965b16c74da2c0a5633dd4cbfe5c8879a5db6a7322d53d668533
Formbook
7417cbf823e1318517ba9b0f02ce10a5b75cd778cde237dc4e4f32f385521617
Formbook
8f61fd5ce3c2fa9186c75e703ce9e38d66538b9fe2214dd78d2df4c2c7cbda1b
Formbook
a714e41091a1a9b5c1a5d5dde50ab30d9ba44655ff38e4a99e69d2e6118f63a9
Formbook
bbce59cd09b98759f1e8de287441906c11a8698581e9a84e302626e48abc7c38
Formbook
e30ffd629a507dd61beb41fb6988ceb6e2f7d311e3f289c66eea2c80a83b20d0
Formbook
+ 3'546 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230814-jxpsxscg2y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
81e62d5531f90e508922d8d3e92a8fc5fee581fd9e0c532bf7358a5451d8eeed
MD5 hash:
f3447ed883bdba298fe7cbdd57aef0fe
SHA1 hash:
f8d4d861277c28e6f8483cbea196ed6725b53902
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/37c5b103-b299-4b12-bbb5-7cc8bf278de6/
SH256 hash:
fe4e13f02beb71ea121b69523b04815d53a82de51a7202239c30921fa00817e9
MD5 hash:
a2b24c3f209b2890a7d1178a2021f71d
SHA1 hash:
09a01ffc5edde48161366aa404d818581765464a
Link:
https://www.unpac.me/results/37c5b103-b299-4b12-bbb5-7cc8bf278de6/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe fe4e13f02beb71ea121b69523b04815d53a82de51a7202239c30921fa00817e9

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/442615/

Comments