popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

bin.exe

Formbook PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Sept. 28, 2021, 3:55 p.m. Sept. 28, 2021, 4:10 p.m.
Size 185.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 9f66d58c838608fdd0be51b576e7185d
SHA256 c63cb761da677849b8382eb1d926569f00a04d57f2c789b63e7f2eb2e368a00c
CRC32 0D1300AB
ssdeep 3072:bBQxEozP3I7juU3cR6Sb26PK4UBepZLK/1Odv0F20p5qt1nfjboH1A:wzH6cYw2iKnBe/LK/1O9w5qLfn2
Yara
  • PE_Header_Zero - PE File Signature
  • Win_Trojan_Formbook_Zero - Used Formbook
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
www.usedtowels.com
A 88.214.207.96
88.214.207.96
www.nsbeneae.com
A 209.17.116.163
209.17.116.163
www.swoern.info
A 150.95.255.38
150.95.255.38
www.digitalimmersioncg.com
A 192.252.151.20
192.252.151.20
www.rlgbsuilds.com
A 166.88.19.180
A 68.68.98.160
A 166.88.19.181
166.88.19.181
IP Address Status Action
150.95.255.38 Active Moloch
164.124.101.2 Active Moloch
166.88.19.181 Active Moloch
192.252.151.20 Active Moloch
209.17.116.163 Active Moloch
88.214.207.96 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49167 -> 192.252.151.20:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 192.252.151.20:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 192.252.151.20:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 209.17.116.163:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 209.17.116.163:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 209.17.116.163:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 166.88.19.181:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 166.88.19.181:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 166.88.19.181:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49164 -> 150.95.255.38:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49164 -> 150.95.255.38:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49164 -> 150.95.255.38:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49165 -> 88.214.207.96:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49165 -> 88.214.207.96:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49165 -> 88.214.207.96:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

suspicious_features GET method with no useragent header suspicious_request GET http://www.swoern.info/hp6s/?uTuD=4T5YGQUYHOUszNOY444hn7mmf6FrtM+AFTjOJC+Py6Ag/b5xU53y9DZCTZxlx39fr7jwKFEI&Kj6dY=ATxxQ4G
suspicious_features GET method with no useragent header suspicious_request GET http://www.usedtowels.com/hp6s/?uTuD=LFde+ie6fWvOLN7PGF70NwTYUX7Jm/JyGjPm4XWrD0fHhgM6rcivN6x0AQjvoX504Y/z8KH4&Kj6dY=ATxxQ4G
suspicious_features GET method with no useragent header suspicious_request GET http://www.rlgbsuilds.com/hp6s/?uTuD=Fw5YSRn6B6q7Vo6CTsfssUahdbXa4r2ZD7nmGGCHLkY8GDkOmUQxWePCsmLEOuwwrsL9h5YF&Kj6dY=ATxxQ4G
suspicious_features GET method with no useragent header suspicious_request GET http://www.digitalimmersioncg.com/hp6s/?uTuD=ecMUAiyMfvfWY8rzTadGuccx8GuXMB82GuQzWJgBWyxQ3c9DaRyVLVaaQhcCvX5nneSnIplK&Kj6dY=ATxxQ4G
suspicious_features GET method with no useragent header suspicious_request GET http://www.nsbeneae.com/hp6s/?uTuD=SHpD87a5Dg8Vmq/a7y609SjdXnsgQw3juNG92/8unMmD+3syTbnlJP5vOUTgSZV81y/Tfjod&Kj6dY=ATxxQ4G
request GET http://www.swoern.info/hp6s/?uTuD=4T5YGQUYHOUszNOY444hn7mmf6FrtM+AFTjOJC+Py6Ag/b5xU53y9DZCTZxlx39fr7jwKFEI&Kj6dY=ATxxQ4G
request GET http://www.usedtowels.com/hp6s/?uTuD=LFde+ie6fWvOLN7PGF70NwTYUX7Jm/JyGjPm4XWrD0fHhgM6rcivN6x0AQjvoX504Y/z8KH4&Kj6dY=ATxxQ4G
request GET http://www.rlgbsuilds.com/hp6s/?uTuD=Fw5YSRn6B6q7Vo6CTsfssUahdbXa4r2ZD7nmGGCHLkY8GDkOmUQxWePCsmLEOuwwrsL9h5YF&Kj6dY=ATxxQ4G
request GET http://www.digitalimmersioncg.com/hp6s/?uTuD=ecMUAiyMfvfWY8rzTadGuccx8GuXMB82GuQzWJgBWyxQ3c9DaRyVLVaaQhcCvX5nneSnIplK&Kj6dY=ATxxQ4G
request GET http://www.nsbeneae.com/hp6s/?uTuD=SHpD87a5Dg8Vmq/a7y609SjdXnsgQw3juNG92/8unMmD+3syTbnlJP5vOUTgSZV81y/Tfjod&Kj6dY=ATxxQ4G
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1328
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00930000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0002d200', u'virtual_address': u'0x00001000', u'entropy': 7.40708035367671, u'name': u'.text', u'virtual_size': u'0x0002d0f4'} entropy 7.40708035368 description A section with a high entropy has been found
entropy 1.0 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Razy.679962
FireEye Generic.mg.9f66d58c838608fd
ALYac Gen:Variant.Razy.679962
Cylance Unsafe
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
K7GW Trojan ( 00536d121 )
K7AntiVirus Trojan ( 00536d121 )
Cyren W32/Formbook.A.gen!Eldorado
Symantec Trojan.Formbook
ESET-NOD32 a variant of Win32/Formbook.AA
APEX Malicious
ClamAV Win.Malware.Formbook-7399661-0
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Gen:Variant.Razy.679962
NANO-Antivirus Virus.Win32.Gen.ccmw
Avast Win32:Formbook-B [Trj]
Ad-Aware Gen:Variant.Razy.679962
Emsisoft Gen:Variant.Razy.679962 (B)
DrWeb Trojan.Siggen9.48175
McAfee-GW-Edition BehavesLike.Win32.Generic.cc
Sophos ML/PE-A + Troj/Formbook-A
SentinelOne Static AI - Malicious PE
Avira TR/Crypt.ZPACK.Gen
Microsoft Trojan:Win32/Formbook!MTB
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Gen:Variant.Razy.679962
Cynet Malicious (score: 100)
Acronis suspicious
McAfee GenericRXCD-ZZ!9F66D58C8386
MAX malware (ai score=88)
VBA32 BScope.TrojanPSW.Banker
Malwarebytes Spyware.FormBook
Rising Stealer.Formbook!1.C470 (CLASSIC)
Ikarus Trojan-Spy.FormBook
Fortinet W32/Generic.AP.F9B00!tr
BitDefenderTheta AI:Packer.D80251FE1E
AVG Win32:Formbook-B [Trj]
Cybereason malicious.c83860