Sample name: | 8mmZ7Bkoj1.exerenamed because original name is a hash value |
Original sample name: | 64c5d2e74511fbe252cb0351a21a86df6d98ac07bd4cc92a35086b1b1659257a.exe |
Analysis ID: | 1528955 |
MD5: | cce5d60668494a747ca41f5d8b17e76a |
SHA1: | 9f29f6cad0687318f9ce75c0145b68914fd0e422 |
SHA256: | 64c5d2e74511fbe252cb0351a21a86df6d98ac07bd4cc92a35086b1b1659257a |
Tags: | exeFormbookuser-adrian__luca |
Infos: | |
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Formbook, Formbo | FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware. |
|
|
AV Detection |
---|
Source: |
Avira: |
Source: |
ReversingLabs: |
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
||
Source: |
File source: |
Source: |
Integrated Neural Analysis Model: |
Source: |
Joe Sandbox ML: |
Source: |
Static PE information: |
Source: |
Binary string: |
||
Source: |
Binary string: |
||
Source: |
Binary string: |
||
Source: |
Binary string: |
||
Source: |
Binary string: |
||
Source: |
Binary string: |
||
Source: |
Binary string: |
Source: |
Code function: |
6_2_0281C541 |
Source: |
Code function: |
6_2_02809B10 | |
Source: |
Code function: |
6_2_045D04E8 | |
Source: |
Code function: |
7_2_05636CB0 | |
Source: |
Code function: |
7_2_0563604A | |
Source: |
Code function: |
7_2_0563A853 | |
Source: |
Code function: |
7_2_05636008 | |
Source: |
Code function: |
7_2_0563531E | |
Source: |
Code function: |
8_2_000002469BF634E8 |
Networking |
---|
Source: |
Suricata IDS: |
||
Source: |
Suricata IDS: |
||
Source: |
Suricata IDS: |
||
Source: |
Suricata IDS: |
||
Source: |
Suricata IDS: |
||
Source: |
Suricata IDS: |
Source: |
DNS query: |
Source: |
IP Address: |
||
Source: |
IP Address: |
Source: |
ASN Name: |
||
Source: |
ASN Name: |
||
Source: |
ASN Name: |
||
Source: |
ASN Name: |
Source: |
UDP traffic detected without corresponding DNS query: |
||
Source: |
UDP traffic detected without corresponding DNS query: |
||
Source: |
UDP traffic detected without corresponding DNS query: |
||
Source: |
UDP traffic detected without corresponding DNS query: |
||
Source: |
UDP traffic detected without corresponding DNS query: |
||
Source: |
UDP traffic detected without corresponding DNS query: |
||
Source: |
UDP traffic detected without corresponding DNS query: |
||
Source: |
UDP traffic detected without corresponding DNS query: |
||
Source: |
UDP traffic detected without corresponding DNS query: |
||
Source: |
UDP traffic detected without corresponding DNS query: |
Source: |
HTTP traffic detected: |
||
Source: |
HTTP traffic detected: |
||
Source: |
HTTP traffic detected: |
||
Source: |
HTTP traffic detected: |
||
Source: |
HTTP traffic detected: |
||
Source: |
HTTP traffic detected: |
Source: |
DNS traffic detected: |
||
Source: |
DNS traffic detected: |
||
Source: |
DNS traffic detected: |
||
Source: |
DNS traffic detected: |
||
Source: |
DNS traffic detected: |
||
Source: |
DNS traffic detected: |
||
Source: |
DNS traffic detected: |
||
Source: |
DNS traffic detected: |
||
Source: |
DNS traffic detected: |
||
Source: |
DNS traffic detected: |
Source: |
HTTP traffic detected: |
Source: |
HTTP traffic detected: |
||
Source: |
HTTP traffic detected: |