🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f6bb3d785d83824db8937c7b231cbe7129547b0aede50ecd8fb998ffc4c3b2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f6bb3d785d83824db8937c7b231cbe7129547b0aede50ecd8fb998ffc4c3b2b
SHA3-384 hash: 9420a9283445ad9e7e7a51ab25f9d20476fb2d21279e2608dcffc96f70a760fe2abfbdaec4053afb756252f5c198ce79
SHA1 hash: 47497760100569b18f745c49371b39a8f9f5347d
MD5 hash: ab7c1667d73edef02a09d99a9705a7dd
humanhash: failed-august-romeo-muppet
File name:PEDIDOHOY.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'047'600 bytes
First seen:2026-11-05 13:22:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 9be4f90f50c714bc00cc8beb2e137299 (19 x Formbook, 9 x RemcosRAT, 3 x ValleyRAT)
ssdeep 24576:nGZ+s7mLqJNhLFzR8WeMGapoRFwBCTrMK9N7rUIX8:GDymNx8xDaCK3ytUu
TLSH T14B250139264588D2C03A0FBD85A3D39151377D6C2672CA9F96207FBB3C315ACAF36685
TrID 45.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
18.0% (.EXE) Win64 Executable (generic) (6522/11/2)
13.9% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.6% (.ICL) Windows Icons Library (generic) (2059/9)
5.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon 5c9c92a2a4c0e471 (3 x Formbook)
Reporter ni_fi_701
Tags:exe FormBook signed

Code Signing Certificate

Organisation:Hyssops
Issuer:Hyssops
Algorithm:sha256WithRSAEncryption
Valid from:2026-09-26T05:43:22Z
Valid to:2027-09-26T05:43:22Z
Serial number: 770641b8f198e49c4b38dde04d15bd9aa6756f97
Thumbprint Algorithm:SHA256
Thumbprint: cffeb91ba741d05d5fac12e22f2cb11a925fecac56a48c624f97c07244b6cfe8
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
223
Origin country :
AT AT
Vendor Threat Intelligence
Malware configuration found for:
NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/36afa3f4-f3b8-489e-9152-d3230d91a364/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-05 13:28:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e5e52301-103d-4c51-9bbe-1eda17af56a6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/97407/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6aec831862f3df3e73e2ad9a
Tags:
injection particula obfusc
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Searching for the window
Creating a file
Delayed reading of the file
Unauthorized injection to a recently created process
Restart of the analyzed sample
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Launching a process
Creating synchronization primitives
Unauthorized injection to a system process
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
installer installer nsis signed
Link:
https://www.filescan.io/uploads/6aec8303c31b6da6fa170b50/reports/b4dc3a18-3eeb-4a77-a204-5640d6e1a56e/overview
Verdict:
Malicious
Labled as:
W64/Guloader.CS
Link:
https://www.hybrid-analysis.com/sample/0f6bb3d785d83824db8937c7b231cbe7129547b0aede50ecd8fb998ffc4c3b2b
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-11-05T05:15:00Z UTC
Last seen:
2026-11-05T06:26:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/0f6bb3d785d83824db8937c7b231cbe7129547b0aede50ecd8fb998ffc4c3b2b/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c7c62863-3a43-4d6a-825c-52dac5ecaece
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1998997
Signature
AI detected suspicious PE / MSI digital signature
Creates a thread in another existing process (thread injection)
Found direct / indirect Syscall (likely to bypass EDR)
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses whoami command line tool to query computer and username
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1998997 Sample: PEDIDOHOY.exe Startdate: 05/11/2026 Architecture: WINDOWS Score: 100 37 www.dynasday.xyz 2->37 39 www.68666872.xyz 2->39 41 17 other IPs or domains 2->41 47 Multi AV Scanner detection for submitted file 2->47 49 Yara detected FormBook 2->49 51 Uses whoami command line tool to query computer and username 2->51 55 3 other signatures 2->55 8 t6vYW1v0.exe 2->8 injected 11 PEDIDOHOY.exe 2 32 2->11         started        14 z8D848elqeMep.exe 2->14 injected 16 YkbKJj3fXuG.exe 2->16 injected signatures3 53 Performs DNS queries to domains with low reputation 39->53 process4 dnsIp5 77 Maps a DLL or memory area into another process 8->77 79 Uses whoami command line tool to query computer and username 8->79 81 Found direct / indirect Syscall (likely to bypass EDR) 8->81 19 whoami.exe 13 8->19         started        29 C:\Users\user\AppData\Local\...\System.dll, PE32+ 11->29 dropped 83 Hides threads from debuggers 11->83 85 Unusual module load detection (module proxying) 11->85 87 Switches to a custom stack to bypass stack traces 11->87 22 PEDIDOHOY.exe 6 11->22         started        25 HOSTNAME.EXE 14->25         started        31 www.dynasday.xyz 203.161.49.11, 49719, 49720, 49721 NAMECHEAP-NET-NamecheapIncUS United States 16->31 33 68666872.xyz 206.168.149.10, 49715, 49716, 49717 FIBERSTATE-FiberStateLLCUS United States 16->33 35 7 other IPs or domains 16->35 file6 signatures7 process8 dnsIp9 57 Tries to steal Mail credentials (via file / registry access) 19->57 59 Tries to harvest and steal browser information (history, passwords, etc) 19->59 61 Modifies the context of a thread in another process (thread injection) 19->61 63 Switches to a custom stack to bypass stack traces 19->63 27 firefox.exe 19->27         started        43 drive.usercontent.google.com 142.250.188.1, 443, 49707 GOOGLE-GoogleLLCUS United States 22->43 45 drive.google.com 142.250.72.14, 443, 49705 GOOGLE-GoogleLLCUS United States 22->45 65 Hides threads from debuggers 22->65 67 Creates a thread in another existing process (thread injection) 22->67 69 Found direct / indirect Syscall (likely to bypass EDR) 22->69 71 Maps a DLL or memory area into another process 25->71 73 Queues an APC in another process (thread injection) 25->73 75 Unusual module load detection (module proxying) 25->75 signatures10 process11
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/ab7c1667d73edef02a09d99a9705a7dd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f6bb3d785d83824db8937c7b231cbe7129547b0aede50ecd8fb998ffc4c3b2b/
Threat name:
Win64.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-11-05 09:29:16 UTC
File Type:
PE+ (Exe)
Extracted files:
17
AV detection:
14 of 23 (60.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b5v3hv4f3a4cjw4jg7d3emol44jjkr5qv3pfb3gy7omy77cmhmvq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery privilege_escalation
Link:
https://tria.ge/reports/261105-qma1cawy9j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Contacts third-party web service commonly abused for C2
Loads dropped DLL
Malware Family:
n/a
Verdict:
Malicious
Tags:
invalid_signature evasion
YARA:
win_token
Link:
https://app.threat.zone/submission/d4b0ab9c-f82f-4884-af55-eb8af8f200ba
Malware Family:
nsis
Create hunting rule
Malicious:
True
Tags:
signed obfuscated overlay 64bits invalid-signature
Link:
https://intel.virussign.com/intelligence/file/0f6bb3d785d83824db8937c7b231cbe7129547b0aede50ecd8fb998ffc4c3b2b
Unpacked files
SH256 hash:
0f6bb3d785d83824db8937c7b231cbe7129547b0aede50ecd8fb998ffc4c3b2b
MD5 hash:
ab7c1667d73edef02a09d99a9705a7dd
SHA1 hash:
47497760100569b18f745c49371b39a8f9f5347d
Link:
https://www.unpac.me/results/b4fbc482-478c-4058-8e1f-79cf013efa0d/
SH256 hash:
d4f092a13204f8f98be183d1ee25a0c53b4b3b98073f0a586044ccebac3be2ac
MD5 hash:
c5bf6c30d10406ff0b675d4b669742a8
SHA1 hash:
5f14fed8ea503f745c8c76e848b40637a8b934ed
Link:
https://www.unpac.me/results/b4fbc482-478c-4058-8e1f-79cf013efa0d/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0f6bb3d785d8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0f6bb3d785d83824db8937c7b231cbe7129547b0aede50ecd8fb998ffc4c3b2b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Win_Clipboard_Clipper_Thengavar
Create hunting rule
Author:Thengavar
Description:Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks
Rule name:WIN_Malware_Formbook_ForgeAuto_dc5021a0
Create hunting rule
Author:Marjoriefort
Description:Detects Formbook (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/97407/

Comments