MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02f63cc487c184315612a286990150d9193d8dd1024e930fc289f90a92fbcf00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 16

Intelligence 16 IOCs YARA 17 File information Comments

SHA256 hash:	02f63cc487c184315612a286990150d9193d8dd1024e930fc289f90a92fbcf00
SHA3-384 hash:	55c3f4a87ce77c7f4a8398964fccc2ff91941aea52f13c41b56130cbe84fd0522cd781e78005f7fa4f35ca4a1d1a492e
SHA1 hash:	8ae54c2fcebf5af8af5f50117a09f1c7a7d84497
MD5 hash:	390d93b3499ad9f549745649d5ac735a
humanhash:	zulu-kilo-oscar-california
File name:	02f63cc487c184315612a286990150d9193d8dd1024e930fc289f90a92fbcf00
Download:	download sample
Signature	Formbook Create hunting rule
File size:	866'816 bytes
First seen:	2025-12-08 14:35:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ef471c0edf1877cd5a881a6a8bf647b9 (83 x Formbook, 33 x Loki, 31 x Loda)
ssdeep	12288:WOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi/w/H67QnM5FVjULiB6PlahJSGX:Wq5TfcdHj4fmbB/H67QnMljULiB+gS0
Threatray	2'766 similar samples on MalwareBazaar
TLSH	T1CC05AC2B6432529DDBDD25304F4D72A90983AF20989F3688F477F905F232973366D86E
TrID	33.9% (.EXE) UPX compressed Win32 Executable (27066/9/6) 33.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 13.1% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.6% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	adrian__luca
Tags:	exe FormBook UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	866'816 bytes
File size (de-compressed) :	1'352'192 bytes
Format:	win32/pe
Unpacked file:	d9281de206f0a6ba959317eaf87ab62e6d57d9bed3a31f81308a2fea95f3a42e

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/e13df0cd-4c96-45d7-b979-eaeb85b5c9ae/

Malware family:

n/a

ID:

File name:

02f63cc487c184315612a286990150d9193d8dd1024e930fc289f90a92fbcf00

Verdict:

No threats detected

Analysis date:

2025-12-08 15:19:01 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/79855b66-aad7-4d35-9249-ed045459b3ac

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/43071/

Detection(s):

Win.Trojan.Autoit-10037269-0

SecuriteInfo.com.W32.Trojan.VORE-2106.1542.UNOFFICIAL

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6936e25adb58e1a2c22b8242

Tags:

n/a

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug autoit compiled-script control fingerprint hacktool installer-heuristic lolbin microsoft_visual_cc packed packed packed upx

Link:

https://www.filescan.io/uploads/6936e225bc15eab491f72ac4/reports/336cdb4a-abec-4af5-9a47-c07277c92f06/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/02f63cc487c184315612a286990150d9193d8dd1024e930fc289f90a92fbcf00

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-11-09T21:56:00Z UTC

Last seen:

2025-11-21T00:23:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/02f63cc487c184315612a286990150d9193d8dd1024e930fc289f90a92fbcf00/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/46b98075-3554-4c8c-b692-088844f0a0b7

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/02f63cc487c184315612a286990150d9193d8dd1024e930fc289f90a92fbcf00

Verdict:

Malware

YARA:

5 match(es)

Tags:

AutoIt Decompiled Executable PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/390d93b3499ad9f549745649d5ac735a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/02f63cc487c184315612a286990150d9193d8dd1024e930fc289f90a92fbcf00/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-11-10 00:58:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 38 (73.68%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=al3dzrehygcdcvqsukdjsakq3emt3dorajhjgd6crh4qvex3z4aa._file

Verdict:

malicious

Label(s):

autoit

formbook

Formbook

2968dbd64af4b7668158b729f043c71b653bec1d5e4c965359bbc662a4cd3fda

Formbook

6e2c46144ecfe43364ca64844c46562391c994bac618e8c6e122922d14c64964

Formbook

9adeec7138d5d6854c3632ed0560edf5566d75347ffb0b13aa441ba89aed930a

Formbook

c621cdef483f72a72f9e9b3296c85c7c8d064a707dfdd2c11d7fc21d75d123ef

Formbook

d3ad7e22a740b5654dc36d3d803984ad83c9b2627edee55630c5a9816d42c085

Formbook

ffc80b59d812eb62c2a8534202477ac2d02cb5e1b6ee53939142e300e31cbb12

Formbook

+ 2'756 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan upx

Link:

https://tria.ge/reports/251208-ryaz6aex9g/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

Formbook payload

Formbook

Formbook family

Verdict:

Malicious

Tags:

Win.Trojan.Autoit-10037269-0

YARA:

n/a

Link:

https://app.threat.zone/submission/8adc26e7-d3aa-44d7-a8dd-366ef111bd38

Unpacked files

SH256 hash:

d9281de206f0a6ba959317eaf87ab62e6d57d9bed3a31f81308a2fea95f3a42e

MD5 hash:

5ba4358e8907d1db9444a6713e4954c3

SHA1 hash:

acda1edb4ace7c77edec30db2cf2bcac60782120

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/513bdcf4-e70c-4f9b-82b2-8d3cd095982c/

Parent samples :

02f63cc487c184315612a286990150d9193d8dd1024e930fc289f90a92fbcf00
d9281de206f0a6ba959317eaf87ab62e6d57d9bed3a31f81308a2fea95f3a42e

SH256 hash:

7bc02e40d267f0806ccbe4ddf692cf7e30e15aea70d7459a62be513ef77c43fa

MD5 hash:

64bb70052b94833bae8c6c2ed8355480

SHA1 hash:

3c5b9df2ff518b5026fa23510781e3d1cd15cd5a

Link:

https://www.unpac.me/results/513bdcf4-e70c-4f9b-82b2-8d3cd095982c/

SH256 hash:

10923ea59dd5331d65d4c3c6f3b2affe4fe0a0327df3c318ca00ac14e593f33c

MD5 hash:

b2f4c247b5952aba37ea591d73e90d62

SHA1 hash:

f56579ede6c544ebe589959fc0f9b2476990bb62

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/513bdcf4-e70c-4f9b-82b2-8d3cd095982c/

Parent samples :

4c43b309ba3f6388617f713f68150812c71bf42bbb6de40399082fca221bc336
44d76c2813cbcbbc38602cf85005884c492f6eb76fbdac3e8279633d75fc5a0d
480eba71b028d39614cfb7d3f83e75358348d256f8d27e687a4a85ba7499a1a4
a63518cd5599294dd399f039241d3447a0c23ef0fcefd13fd3fda953fde6dfa6
b218314a9dd2486d8bdaec64b879b8a174c01047066ede10128cebebe74ce22c
fe9da91bd2eda566901cf68e6e7d4ef9a3f755dff630931b1f1085b8a1630950
51fcf05f52722a269f61e188e92353ce667a5d50cfae39f98e58c5dda12836bf
d03d5c962c99335e1ca1701937074be95c015d8f7cf37828c178b35acbd99309
ea03b1c2d2aa3ec74bf4194c7f623670e13df20b4bfdaae11f2e8604521f77e4
6e2c46144ecfe43364ca64844c46562391c994bac618e8c6e122922d14c64964
02f63cc487c184315612a286990150d9193d8dd1024e930fc289f90a92fbcf00
d9281de206f0a6ba959317eaf87ab62e6d57d9bed3a31f81308a2fea95f3a42e
bcc62e2765d44de31aa80c93c3534a90dc3210899d892fafe53b6d0d3d78ddad
8c7cd6590e72250104c91c5dbff66bc376342ec4f0e870d913349db19ceacee4
a7b250c97316686083cfa7c3d5c9aa35aeaa2090e4b27a7a2a88ab8986dc6b54

SH256 hash:

02f63cc487c184315612a286990150d9193d8dd1024e930fc289f90a92fbcf00

MD5 hash:

390d93b3499ad9f549745649d5ac735a

SHA1 hash:

8ae54c2fcebf5af8af5f50117a09f1c7a7d84497

Link:

https://www.unpac.me/results/513bdcf4-e70c-4f9b-82b2-8d3cd095982c/

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/02f63cc487c1/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/02f63cc487c184315612a286990150d9193d8dd1024e930fc289f90a92fbcf00

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	TH_Win_ETW_Bypass_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Windows ETW Bypass Detection Rule - 2025
Reference:	https://cyfare.net/

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Formbook

exe 02f63cc487c184315612a286990150d9193d8dd1024e930fc289f90a92fbcf00

(this sample)

Formbook

exe d9281de206f0a6ba959317eaf87ab62e6d57d9bed3a31f81308a2fea95f3a42e

Cape

https://www.capesandbox.com/analysis/43071/

Dropping

SHA256 d9281de206f0a6ba959317eaf87ab62e6d57d9bed3a31f81308a2fea95f3a42e

Dropping

MD5 5ba4358e8907d1db9444a6713e4954c3

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample