Edit tour

Windows Analysis Report
1.exe

Overview

General Information

Sample Name:	1.exe
Analysis ID:	1345564
MD5:	60ff6dcfe9ed4741b4ffb91cd3bd6895
SHA1:	89bec9456328957250b9ec8b30ec87495ab1a2e1
SHA256:	6d923f02c2252e4a2ea98a8685fc5237354e2853791855f1a451a390dd85cbb9
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Antivirus / Scanner detection for submitted sample

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Sample uses process hollowing technique

Maps a DLL or memory area into another process

.NET source code references suspicious native API functions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

.NET source code contains method to dynamically call methods (often used by packers)

Queues an APC in another process (thread injection)

.NET source code contains very large array initializations

.NET source code contains very large strings

Tries to detect virtualization through RDTSC time measurements

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Tries to resolve many domain names, but no domain seems valid

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Checks if the current process is being debugged

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

1.exe (PID: 1892 cmdline: C:\Users\user\Desktop\1.exe MD5: 60FF6DCFE9ED4741B4FFB91CD3BD6895)

1.exe (PID: 2136 cmdline: C:\Users\user\Desktop\1.exe MD5: 60FF6DCFE9ED4741B4FFB91CD3BD6895)

explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

colorcpl.exe (PID: 3716 cmdline: C:\Windows\SysWOW64\colorcpl.exe MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)

cmd.exe (PID: 2212 cmdline: /c del "C:\Users\user\Desktop\1.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/ https://asec.ahnlab.com/en/32149/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.switchtoambitwithmirtha.com/jskg/"], "decoy": ["jajaten.com", "pnorg.net", "rccarquibogota.com", "marcomarabiamea.com", "theligue.com", "mdearpet.com", "barokahsrivillage.com", "wisdomtoothguru.com", "srteamsex.com", "erotictoybox.com", "278698.com", "victimaccidents.com", "bootyfashions.com", "stomasto.site", "canalysisconsulting.com", "printandmail.legal", "bestcureforbackpain.com", "apanifitness.com", "smartabletech.com", "facialsteamerofficial.com", "cookclassesfishes.com", "ayanmobile.com", "cannapharmaus.com", "lactationdrink.com", "enrgsystems.info", "f1leghecodemasters.net", "topazkibblez.com", "appbecause.com", "256barrington.com", "snapmoneyexchangellc.com", "kriolland.com", "7255399.com", "realoneathletics.info", "illustriousevents.com", "moonman.services", "dog2meeting.com", "successwithyolandafgreen.com", "freshlookconsulting.net", "3bcreditwatch.com", "lacroixundkress.com", "beaujolaisboston.com", "breakawayfc.com", "bollmasonry.com", "jiujitsuspa.com", "zirangaobai.com", "capitalmedicalsupplies.net", "swavhca.com", "pereiranatalia.com", "lbarco.com", "revistabrasileiramarketing.info", "carportaccessory.com", "kvrkl.com", "handledlife.com", "groups-post-sales-2678493.xyz", "rapidprintz.com", "buzzkeel.com", "divinityemerald.com", "ppc-listing.info", "coryfireshop.com", "mimipopuppicnics.com", "votehealey.com", "saraadamchak.com", "winwinwin365.net", "tprmt.com"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2046232928.0000000001270000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_Diceloader_15eeb7b9	unknown	unknown	0xa085:$a2: E9 E8 61 FF FF C3 E8
00000003.00000002.4456583793.00000000103B0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Diceloader_15eeb7b9	unknown	unknown	0x43085:$a2: E9 E8 61 FF FF C3 E8
00000004.00000002.4449703704.0000000004C50000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_Diceloader_15eeb7b9	unknown	unknown	0xa085:$a2: E9 E8 61 FF FF C3 E8
00000004.00000002.4449219136.00000000030B0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.4449219136.00000000030B0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.4449219136.00000000030B0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6171:$a1: 3C 30 50 4F 53 54 74 09 40 0x1aab0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x97bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14887:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000004.00000002.4449219136.00000000030B0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.4449219136.00000000030B0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000002.4456692490.00000000108B0000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Diceloader_15eeb7b9	unknown	unknown	0xcf085:$a2: E9 E8 61 FF FF C3 E8
00000000.00000002.2021348011.0000000002E71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000002.00000002.2045843901.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.2045843901.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2045843901.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6171:$a1: 3C 30 50 4F 53 54 74 09 40 0x1aab0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x97bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14887:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000002.00000002.2045843901.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.2045843901.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.2021713062.0000000003E79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.2021713062.0000000003E79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000000.00000002.2021713062.0000000003E79000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2d9b41:$a1: 3C 30 50 4F 53 54 74 09 40 0x300f61:$a1: 3C 30 50 4F 53 54 74 09 40 0x2ee480:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x3158a0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x2dd18f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x3045af:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x2e8257:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 0x30f677:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000000.00000002.2021713062.0000000003E79000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x2dbfb8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x2dc342:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x3033d8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x303762:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x2e8055:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x30f475:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x2e7b41:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x30ef61:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x2e8157:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x30f577:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x2e82cf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x30f6ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x2dcd5a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x30417a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x2e6dbc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x30e1dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x2ddad2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x304ef2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x2ed147:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x314567:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x2ee1ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.2021713062.0000000003E79000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x2ea079:$sqlite3step: 68 34 1C 7B E1 0x2ea18c:$sqlite3step: 68 34 1C 7B E1 0x311499:$sqlite3step: 68 34 1C 7B E1 0x3115ac:$sqlite3step: 68 34 1C 7B E1 0x2ea0a8:$sqlite3text: 68 38 2A 90 C5 0x2ea1cd:$sqlite3text: 68 38 2A 90 C5 0x3114c8:$sqlite3text: 68 38 2A 90 C5 0x3115ed:$sqlite3text: 68 38 2A 90 C5 0x2ea0bb:$sqlite3blob: 68 53 D8 7F 8C 0x2ea1e3:$sqlite3blob: 68 53 D8 7F 8C 0x3114db:$sqlite3blob: 68 53 D8 7F 8C 0x311603:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.2046258222.0000000001289000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_Diceloader_15eeb7b9	unknown	unknown	0x1085:$a2: E9 E8 61 FF FF C3 E8
00000004.00000002.4449653470.0000000004BC0000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_Diceloader_15eeb7b9	unknown	unknown	0xa085:$a2: E9 E8 61 FF FF C3 E8
00000004.00000002.4449610086.0000000004B90000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.4449610086.0000000004B90000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.4449610086.0000000004B90000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6171:$a1: 3C 30 50 4F 53 54 74 09 40 0x1aab0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x97bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14887:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000004.00000002.4449610086.0000000004B90000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.4449610086.0000000004B90000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.4449093142.0000000002E20000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.4449093142.0000000002E20000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.4449093142.0000000002E20000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6171:$a1: 3C 30 50 4F 53 54 74 09 40 0x1aab0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x97bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14887:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000004.00000002.4449093142.0000000002E20000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.4449093142.0000000002E20000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: 1.exe PID: 1892	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 1.exe PID: 1892	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x74fe7:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: 1.exe PID: 2136	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x329c7:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: colorcpl.exe PID: 3716	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xd2e13:$a1: 3C 30 50 4F 53 54 74 09 40 0x1637f6:$a1: 3C 30 50 4F 53 54 74 09 40 0x16533b:$a1: 3C 30 50 4F 53 54 74 09 40
Click to see the 31 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.1.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.2.1.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.1.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5371:$a1: 3C 30 50 4F 53 54 74 09 40 0x19cb0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x89bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x13a87:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
2.2.1.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x858a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9302:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18977:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.2.1.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158a9:$sqlite3step: 68 34 1C 7B E1 0x159bc:$sqlite3step: 68 34 1C 7B E1 0x158d8:$sqlite3text: 68 38 2A 90 C5 0x159fd:$sqlite3text: 68 38 2A 90 C5 0x158eb:$sqlite3blob: 68 53 D8 7F 8C 0x15a13:$sqlite3blob: 68 53 D8 7F 8C
2.2.1.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.2.1.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.1.exe.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6171:$a1: 3C 30 50 4F 53 54 74 09 40 0x1aab0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x97bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14887:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
2.2.1.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.2.1.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
0.2.1.exe.407d900.4.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.1.exe.407d900.4.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0.2.1.exe.407d900.4.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xd5241:$a1: 3C 30 50 4F 53 54 74 09 40 0xfc661:$a1: 3C 30 50 4F 53 54 74 09 40 0xe9b80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x110fa0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xd888f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0xffcaf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0xe3957:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 0x10ad77:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0.2.1.exe.407d900.4.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xd76b8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xd7a42:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xfead8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xfee62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xe3755:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x10ab75:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xe3241:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x10a661:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xe3857:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x10ac77:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xe39cf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x10adef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xd845a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xff87a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xe24bc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1098dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xd91d2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1005f2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xe8847:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x10fc67:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xe98ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0.2.1.exe.407d900.4.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0xe5779:$sqlite3step: 68 34 1C 7B E1 0xe588c:$sqlite3step: 68 34 1C 7B E1 0x10cb99:$sqlite3step: 68 34 1C 7B E1 0x10ccac:$sqlite3step: 68 34 1C 7B E1 0xe57a8:$sqlite3text: 68 38 2A 90 C5 0xe58cd:$sqlite3text: 68 38 2A 90 C5 0x10cbc8:$sqlite3text: 68 38 2A 90 C5 0x10cced:$sqlite3text: 68 38 2A 90 C5 0xe57bb:$sqlite3blob: 68 53 D8 7F 8C 0xe58e3:$sqlite3blob: 68 53 D8 7F 8C 0x10cbdb:$sqlite3blob: 68 53 D8 7F 8C 0x10cd03:$sqlite3blob: 68 53 D8 7F 8C
0.2.1.exe.3fbfe60.5.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.1.exe.3fbfe60.5.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0.2.1.exe.3fbfe60.5.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x192ce1:$a1: 3C 30 50 4F 53 54 74 09 40 0x1ba101:$a1: 3C 30 50 4F 53 54 74 09 40 0x1a7620:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1cea40:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x19632f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x1bd74f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x1a13f7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 0x1c8817:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: FormBook

Yara Signatures

Memory Dumps

Unpacked PEs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: FormBook

Yara Signatures

Memory Dumps

Unpacked PEs

Windows Analysis Report
1.exe