Loading ...

Play interactive tourEdit tour

Analysis Report AqWqqv8iT7

Overview

General Information

Sample Name:AqWqqv8iT7 (renamed file extension from none to img)
Analysis ID:254662
MD5:2649390ac400353beea8b806a6e0644d
SHA1:e73bc20617ead97faecdea7c787141944ce5c078
SHA256:c35c0afc52b234052ec1dddb9df2e0c2d1229201c4a53ea50bb23b261a229399
Errors
  • Nothing to analyse, Joe Sandbox has not found any analysis process or sample
  • Corrupt sample or wrongly selected analyzer. Details: No application is associated with the specified file for this operation.

Detection

FormBook
Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Yara detected FormBook
Sample file is different than original file name gathered from version info
Yara signature match

Classification

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
AqWqqv8iT7.imgJoeSecurity_FormBookYara detected FormBookJoe Security
    AqWqqv8iT7.imgFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x670ea:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x67cb2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x2f4aa:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x2eb60:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x2fc51:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x68b39:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x6a97b:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x3959d:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x3b65a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    AqWqqv8iT7.imgFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x34e0d:$sqlite3step: 68 34 1C 7B E1
    • 0x34f52:$sqlite3step: 68 34 1C 7B E1
    • 0x34dd6:$sqlite3text: 68 38 2A 90 C5
    • 0x34f09:$sqlite3text: 68 38 2A 90 C5
    • 0x34dec:$sqlite3blob: 68 53 D8 7F 8C
    • 0x34f1c:$sqlite3blob: 68 53 D8 7F 8C

    Sigma Overview

    No Sigma rule has matched

    Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Yara detected FormBookShow sources
    Source: Yara matchFile source: AqWqqv8iT7.img, type: SAMPLE

    E-Banking Fraud:

    barindex
    Yara detected FormBookShow sources
    Source: Yara matchFile source: AqWqqv8iT7.img, type: SAMPLE

    System Summary:

    barindex
    Malicious sample detected (through community Yara rule)Show sources
    Source: AqWqqv8iT7.img, type: SAMPLEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
    Source: AqWqqv8iT7.img, type: SAMPLEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
    Source: AqWqqv8iT7.imgBinary or memory string: OriginalFilenamenew order 647474_pdf.exeD vs AqWqqv8iT7.img
    Source: AqWqqv8iT7.img, type: SAMPLEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
    Source: AqWqqv8iT7.img, type: SAMPLEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
    Source: classification engineClassification label: mal56.troj.winIMG@0/0@0/0

    Stealing of Sensitive Information:

    barindex
    Yara detected FormBookShow sources
    Source: Yara matchFile source: AqWqqv8iT7.img, type: SAMPLE

    Remote Access Functionality:

    barindex
    Yara detected FormBookShow sources
    Source: Yara matchFile source: AqWqqv8iT7.img, type: SAMPLE

    Mitre Att&ck Matrix

    No Mitre Att&ck techniques found

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    No Antivirus matches

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    No Antivirus matches

    Domains and IPs

    Contacted Domains

    No contacted domains info

    Contacted IPs

    No contacted IP infos

    General Information

    Joe Sandbox Version:29.0.0 Ocean Jasper
    Analysis ID:254662
    Start date:31.07.2020
    Start time:11:31:07
    Joe Sandbox Product:CloudBasic
    Overall analysis duration:0h 1m 47s
    Hypervisor based Inspection enabled:false
    Report type:full
    Sample file name:AqWqqv8iT7 (renamed file extension from none to img)
    Cookbook file name:default.jbs
    Analysis system description:w10x64 Windows 10 64 bit v1803 with Office Professional Plus 2016, IE 11, Adobe Reader DC 19, Java 8 Update 211
    Number of analysed new started processes analysed:0
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • EGA enabled
    • HDC enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Detection:MAL
    Classification:mal56.troj.winIMG@0/0@0/0
    Cookbook Comments:
    • Adjust boot time
    • Enable AMSI
    • Unable to launch sample, stop analysis
    Errors:
    • Nothing to analyse, Joe Sandbox has not found any analysis process or sample
    • Corrupt sample or wrongly selected analyzer. Details: No application is associated with the specified file for this operation.

    Simulations

    Behavior and APIs

    No simulations

    Created / dropped Files

    No created / dropped files found

    Static File Info

    General

    File type:ISO 9660 CD-ROM filesystem data '20200730_0341'
    Entropy (8bit):5.586086192008684
    TrID:
    • ImgBurn Image (2052548/1) 49.86%
    • null bytes (2050048/1) 49.80%
    • Photoshop Action (5010/6) 0.12%
    • Lotus 123 Worksheet (generic) (2007/4) 0.05%
    • HSC music composer song (1267/141) 0.03%
    File name:AqWqqv8iT7.img
    File size:522240
    MD5:2649390ac400353beea8b806a6e0644d
    SHA1:e73bc20617ead97faecdea7c787141944ce5c078
    SHA256:c35c0afc52b234052ec1dddb9df2e0c2d1229201c4a53ea50bb23b261a229399
    SHA512:7581dd78280279296b4bcb378516cd371483707f9a0ee9341b7fa8d21d4083d9aa27eba48edc0cb51a672cd3bfaf7d71f5d8ed44642b9dbc6f922a25268030be
    SSDEEP:6144:o3F48TZyEuYaiwtOeo0G2swoPAwDC8+Wn+RbDc9tlrmrQN2mPV:B2huYaftq0GfZPPWNtwrm
    File Content Preview:...............................................................................................................................................................................................................................................................

    File Icon

    Icon Hash:74f0ccccd4c4ecf4

    Network Behavior

    No network behavior found

    Code Manipulations

    Statistics

    System Behavior

    Disassembly

    Reset < >