MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf9fd5adc66ebd40de81eda76543a9b798ad480aab0d0316e7d13a6d51525816. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 3 Yara Comments

SHA256 hash: bf9fd5adc66ebd40de81eda76543a9b798ad480aab0d0316e7d13a6d51525816
SHA3-384 hash: 0ca4015655ec6c31df33bdc1dca9d029d641cefca7a08f51838e92d49608216c659dffb3426e496816ba46d153bc6625
SHA1 hash: 7cb214b2dc8b861e6ee26ac120e494d43035813b
MD5 hash: a48efe002e755fc23f7275abd4ce400b
humanhash: august-crazy-shade-connecticut
File name:a48efe002e755fc23f7275abd4ce400b.exe
Download: download sample
Signature FormBook
File size:311'041 bytes
First seen:2020-06-30 05:31:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0
ssdeep 6144:VPCganN8FCAlaAA1G/IW5a25lm1yhdIWv5UvzzvemF7vH5lWV/F6xtB:7anSFCAcA02aOphdPol7H5lq/+
TLSH C86422131710C5A7C8B602B005B11BE6FF6AF85F5CD37FC68714AE463E81AC65A2E64E
Reporter @abuse_ch
Tags:exe FormBook


Mail intelligence No data
# of uploads 1
# of downloads 31
Origin country US US
CAPE Sandbox Detection:n/a
ClamAV PUA.Win.Downloader.Soft32downloader-6691270-0
CERT.PL MWDB Detection:n/a
ReversingLabs :Status:Malicious
Threat name:Win32.Trojan.Injector
First seen:2020-06-30 00:49:42 UTC
AV detection:22 of 31 (70.97%)
Threat level:   5/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:formbook
Tags:trojan spyware stealer family:formbook persistence evasion
VirusTotal:Virustotal results 19.18%

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download


Executable exe bf9fd5adc66ebd40de81eda76543a9b798ad480aab0d0316e7d13a6d51525816

(this sample)

Delivery method
Distributed via web download