MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10bee70d4e0f6828a3a352e207e973cd9870f40e712fdb59c8f750e8cb56e6d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 9

Intelligence 9 IOCs YARA 11 File information Comments

SHA256 hash:	10bee70d4e0f6828a3a352e207e973cd9870f40e712fdb59c8f750e8cb56e6d6
SHA3-384 hash:	1efb2adddf466fc6d7b54c6c6f1b569a2af841026fb42cd68f14001485b220eccfee7627aa06e17466d73497e6a9efef
SHA1 hash:	66999e5ea2f96179aea09df3a3f0a423cb9a031c
MD5 hash:	4a647d31488eafe8986f2fca99381206
humanhash:	finch-timing-solar-colorado
File name:	PD3920251103.pdf.gz
Download:	download sample
Signature	Formbook Create hunting rule
File size:	696'794 bytes
First seen:	2025-11-05 15:30:05 UTC
Last seen:	Never
File type:	gz
MIME type:	application/x-rar
ssdeep	12288:GelqAJMMdAoZDyX7hjfYj5U9zwtvojIshnciaciSYucPI8rm+60V9AhQFX:GnAJMMhFuatU52ofhnNBYtr9rAhuX
TLSH	T1E7E4230637470334308A36AB53EAE8D07D47574AB375A0E8D829B3765BF832E5A4CCB4
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	FormBook gz

cocaman

Malicious email (T1566.001)
From: "Anu purchase <anu@danadairy.com>" (likely spoofed)
Received: "from danadairy.com (unknown [185.222.58.43]) "
Date: "4 Nov 2025 21:02:12 -0800"
Subject: "RE: CHEESE our ref PD3920"
Attachment: "PD3920251103.pdf.gz"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PD3920251103.pdf.exe
File size:	1'203'200 bytes
SHA256 hash:	4139421ed55c3e312d485d67869250d329a4f2e50407e0fcddd74ee419abf216
MD5 hash:	1ea20c62bf74a94ee38ca47620d777d8
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.28929.RarHeur.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=690b6d11ea0f3e915c232f5c

Tags:

underscore autoit emotet

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script fingerprint installer-heuristic keylogger masquerade microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/690b6d9e85b61a93a737fefe/reports/60e05912-aa92-458c-822d-08409bb2012c/overview

Verdict:

Malicious

Labled as:

Trojan.Downloader

Link:

https://www.hybrid-analysis.com/sample/10bee70d4e0f6828a3a352e207e973cd9870f40e712fdb59c8f750e8cb56e6d6

Verdict:

Malicious

File Type:

rar

First seen:

2025-11-05T01:28:00Z UTC

Last seen:

2025-11-05T10:39:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/10bee70d4e0f6828a3a352e207e973cd9870f40e712fdb59c8f750e8cb56e6d6/results?tab=lookup

Verdict:

Malware

YARA:

1 match(es)

Tags:

AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Rar Archive Suspect

Link:

https://app.malva.re/file/4a647d31488eafe8986f2fca99381206

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/10bee70d4e0f6828a3a352e207e973cd9870f40e712fdb59c8f750e8cb56e6d6/

Verdict:

Malicious

Threat:

Family.FORMBOOK

Link:

https://tip.neiki.dev/file/10bee70d4e0f6828a3a352e207e973cd9870f40e712fdb59c8f750e8cb56e6d6

Threat name:

Script-AutoIt.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-11-05 15:30:35 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

18 of 23 (78.26%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=cc7oodkob5ucri5dklrap2ltzwmhb5aooex5wwoi65iors2w43la._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/251105-tgy2rsas7h/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/10bee70d4e0f6828a3a352e207e973cd9870f40e712fdb59c8f750e8cb56e6d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4 Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/