MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b3d7d40a5368009622f9213af36d9bad2df6dc6d6ee4f0db1975662a339c20a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 7

Intelligence 7 IOCs YARA 8 File information Comments

SHA256 hash:	0b3d7d40a5368009622f9213af36d9bad2df6dc6d6ee4f0db1975662a339c20a
SHA3-384 hash:	b73eb6548a4c6003a459f2ebb1eb417b095367387cbe3cc84f73b5e0123abe4e7080f1262e728409c314853c3d5d6a94
SHA1 hash:	39e032c403a9ed3e95f270223d21228c99078401
MD5 hash:	3057103963cb4cb82d0d93c6799793c4
humanhash:	bakerloo-early-tennis-equal
File name:	New PO009765TY7.r00
Download:	download sample
Signature	Formbook Create hunting rule
File size:	642'360 bytes
First seen:	2025-04-30 07:22:11 UTC
Last seen:	Never
File type:	r00
MIME type:	application/x-rar
ssdeep	12288:qEEnm+E4vTaH9+D7BGTlBqsIbXXPzN9cBaVlDh9rqy/v/WD0e:qZm+vo+PcTlIs8HDjv/WDL
TLSH	T1F0D423C6A2D50E69A745B58DEF0BCB463E580598D270B28E980E718363D650FDA3FC37
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	FormBook r00

cocaman

Malicious email (T1566.001)
From: "hiendt2@tbsgroup.vn" (likely spoofed)
Received: "from [213.209.150.174] (unknown [213.209.150.174]) "
Date: "29 Apr 2025 14:00:22 -0700"
Subject: "RE: New PO009765TY7"
Attachment: "New PO009765TY7.r00"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	New PO009765TY7.exe
File size:	764'936 bytes
SHA256 hash:	653e202a0b1a85eccdd95702ebcf2e54035df05616950307d923ba0450bdcb10
MD5 hash:	e89aa0cd40e396f489715fd03e7bd403
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6810d728cc5fb3600cc48a21

Tags:

spawn shell msil

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

expired-cert invalid-signature obfuscated packed packed packer_detected signed

Link:

https://www.filescan.io/uploads/6811cfdb218c4a98ade8d42e/reports/f8b0b019-54a6-4b9b-a474-aa589e425c40/overview

Verdict:

Suspicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/0b3d7d40a5368009622f9213af36d9bad2df6dc6d6ee4f0db1975662a339c20a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0b3d7d40a5368009622f9213af36d9bad2df6dc6d6ee4f0db1975662a339c20a/

Threat name:

Win32.Backdoor.FormBook

Status:

Malicious

First seen:

2025-04-29 10:48:21 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bm6x2qffg2aasyrpsij26nwzxljn63og23xe6dnrs5lgfizzyifa._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0b3d7d40a5368009622f9213af36d9bad2df6dc6d6ee4f0db1975662a339c20a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)