MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0effaf0dc6d8088a7a68bef26965aefc800665de5ab48a1ee70c482a6aeb79c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0effaf0dc6d8088a7a68bef26965aefc800665de5ab48a1ee70c482a6aeb79c5
SHA3-384 hash: 109afb5626206ee231016cf771745174deebe235fc8f413f28dab83121650898202a2e1cfd94910f982493ba98e70d66
SHA1 hash: 4a50e44fc276b863763ffd3dce355b45594aba30
MD5 hash: 5617ab78ceaf820d524c344598c11ae7
humanhash: south-ack-five-purple
File name:0effaf0dc6d8088a7a68bef26965aefc800665de5ab48a1ee70c482a6aeb79c5
Download: download sample
Signature Formbook
Create hunting rule
File size:715'264 bytes
First seen:2025-09-05 12:27:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ef471c0edf1877cd5a881a6a8bf647b9 (83 x Formbook, 33 x Loki, 31 x Loda)
ssdeep 12288:KOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPicdaM0XqaBBqU+UXT4adJsUTqKKmx3:Kq5TfcdHj4fmbn4qqqU+UXTDJsUeKKe3
Threatray 2'706 similar samples on MalwareBazaar
TLSH T1D2E42351A8888C76FBA23331C17BCF64067D3B31DCD97B5A5788F58EA4712431982B6E
TrID 39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6)
38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
7.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.9% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0effaf0dc6d8088a7a68bef26965aefc800665de5ab48a1ee70c482a6aeb79c5
Verdict:
No threats detected
Analysis date:
2025-09-05 13:57:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c4dc2e97-5330-448b-b296-e2fcc3559ad7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/25292/
Detection(s):
SecuriteInfo.com.W32.Trojan.VORE-2106.1542.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68bad74feb163e0ec18477ce
Tags:
emotet virus spawn
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit compiled-script microsoft_visual_cc obfuscated packed packed packed packer_detected upx
Link:
https://www.filescan.io/uploads/68bada73fe1969faa8a6c208/reports/0a609969-58c9-4663-b19e-e65eab6a905f/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/0effaf0dc6d8088a7a68bef26965aefc800665de5ab48a1ee70c482a6aeb79c5
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-08-12T21:35:00Z UTC
Last seen:
2025-08-12T21:35:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/0effaf0dc6d8088a7a68bef26965aefc800665de5ab48a1ee70c482a6aeb79c5/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dac0a561-5c3f-4cbd-b826-0860effa4d18
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0effaf0dc6d8088a7a68bef26965aefc800665de5ab48a1ee70c482a6aeb79c5
Verdict:
Malware
YARA:
5 match(es)
Tags:
AutoIt Decompiled Executable PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/5617ab78ceaf820d524c344598c11ae7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0effaf0dc6d8088a7a68bef26965aefc800665de5ab48a1ee70c482a6aeb79c5/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-08-13 00:42:46 UTC
File Type:
PE (Exe)
Extracted files:
52
AV detection:
29 of 36 (80.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b3726dog3aeiu6tix3zgszno7saamzo6lk2iuhxhbrecu2xlphcq._file
Verdict:
malicious
Label(s):
autoit
Create hunting rule
Similar samples:
02885088d11eeaf0ce641f961c2e366d0de68b4bcf7f0aaa7fabcaa0046adf14
Formbook
10b08331fe0140164426eb9c6f8c575fd87136e5d8282bfbb6eaf5b3b74126c2
Formbook
170c2b10322d1b2bbd5403091730544828633e2bdf59af1134b1ae1898a8d90c
Formbook
17269b07f8f2f16e1d2139282f27e99834c34ed76548851a229bbe59832cb552
Formbook
5fcfd8333c4687790ed53e4783d8b2ac2d082059f7f1b14e92dd24e41e831740
Formbook
60ca2d9fc5e1a088f6338456580085ccb67c660f9167ef48a8767adec10133df
Formbook
6e135160c22ee220839ecc04ed6f325f75b04869763dede90bb0a35811ccb32c
Formbook
802dbb41ee99e2cb65a36b6d51b3241a961f75af4f19dbd9555702fb40bbca76
Formbook
dedf48566d8ce2a8f63e5e8aac7892ce8f2ff7cb95ad0a1a3222245b9645d2ca
Formbook
error
Formbook
+ 2'696 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan upx
Link:
https://tria.ge/reports/250905-pwkepsztby/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Formbook payload
Formbook
Formbook family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ada83c57-5fe7-44c2-bf61-84214adfc0d3
Unpacked files
SH256 hash:
0effaf0dc6d8088a7a68bef26965aefc800665de5ab48a1ee70c482a6aeb79c5
MD5 hash:
5617ab78ceaf820d524c344598c11ae7
SHA1 hash:
4a50e44fc276b863763ffd3dce355b45594aba30
Link:
https://www.unpac.me/results/2ab39c14-0de7-439d-bd48-687ea6840cac/
SH256 hash:
02077f4fe8a31f68111234524dbd4a8bafa0c52acc6f48b975ac9b68e23c43be
MD5 hash:
17c848215ea6def9d256830f3c3cf3ee
SHA1 hash:
6d32cbf595c968fb07822774453d21265e476ea5
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/2ab39c14-0de7-439d-bd48-687ea6840cac/
Parent samples :
f93e0a8edc73edfe87b73735f8530375d26ccfc916c77a1cca7d20e864b90320
cf6865fc7ac88881c24f2d6276c1898381ab11cefedca177eab385c4d9677149
2bf31de983be33ba7be87131513a7c4102766bda004768f481909c73482e5215
0effaf0dc6d8088a7a68bef26965aefc800665de5ab48a1ee70c482a6aeb79c5
b33b1499b2e2e5d5704d4d32bd1ccfbe345017dcb68f7392d6ef354207633235
0bbf77b0b55e802fad02e1d36fa5293ddc2860d187b35e61e0b51998f46a2312
SH256 hash:
3b564637b0b15286906a6027d4f02be84c1ecc2f2181b8c24c894be62ee301a4
MD5 hash:
865dc24a5364c50a2fbfe5b6482b44be
SHA1 hash:
0304bfceeea8faa0d5df26feec5d3937846a5303
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/2ab39c14-0de7-439d-bd48-687ea6840cac/
SH256 hash:
a96b00b201ff4766047e0abbd20f909d200b37fe3d9affc8a2f940fcf8818688
MD5 hash:
cbb310660c463cfcff2c0c9c7c261898
SHA1 hash:
a156d08bae8656c555c6c8c0c58985e8040ccfc0
Link:
https://www.unpac.me/results/2ab39c14-0de7-439d-bd48-687ea6840cac/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0effaf0dc6d8088a7a68bef26965aefc800665de5ab48a1ee70c482a6aeb79c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/25292/

Comments