MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1434ffad05e041b6b8fb3db75b0d2eb1772c6000d7265415eab71016eb463070. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 10

Intelligence 10 IOCs YARA 11 File information Comments

SHA256 hash:	1434ffad05e041b6b8fb3db75b0d2eb1772c6000d7265415eab71016eb463070
SHA3-384 hash:	115940547b50ad7c66b66261905991d76f76a4c698538eb688456d6aaba396b4cc72cbcf667bf3eed032c383d5354bfe
SHA1 hash:	6debf15d070b674dd7a6e55c6597faa71ae2b71f
MD5 hash:	7e5f81d927dfdffea9d567e023ea1140
humanhash:	hydrogen-ack-minnesota-queen
File name:	Payment Swift Bildirimi.pdf.7z
Download:	download sample
Signature	Formbook Create hunting rule
File size:	696'816 bytes
First seen:	2025-11-05 15:27:32 UTC
Last seen:	2025-11-05 15:27:54 UTC
File type:	7z
MIME type:	application/x-rar
ssdeep	12288:oelqAJMMdAoZDyX7hjfYj5U9zwtvojIshnciaciSYucPI8rm+60V9AhQFI:onAJMMhFuatU52ofhnNBYtr9rAhuI
TLSH	T164E4230637470335308A36AB53EAE8D07D47574AB375A0E8D828B3765BF876E5A4CCB4
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	7z FormBook payment SWIFT

cocaman

Malicious email (T1566.001)
From: "ZIRAAT BANK<mehmetsait.ince@dhmi.gov.tr>" (likely spoofed)
Received: "from dhmi.gov.tr (unknown [185.222.58.40]) "
Date: "4 Nov 2025 22:01:04 -0800"
Subject: "Swift Bildirimi"
Attachment: "Payment Swift Bildirimi.pdf.js"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Payment Swift Bildirimi.pdf.exe
File size:	1'203'200 bytes
SHA256 hash:	4139421ed55c3e312d485d67869250d329a4f2e50407e0fcddd74ee419abf216
MD5 hash:	1ea20c62bf74a94ee38ca47620d777d8
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.28929.RarHeur.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=690b6d11ea0f3e915c232f5c

Tags:

underscore autoit emotet

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/1434ffad05e041b6b8fb3db75b0d2eb1772c6000d7265415eab71016eb463070/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script fingerprint installer-heuristic keylogger masquerade microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/690b6d1085b61a93a737fcdb/reports/ce8abc2d-bc13-412f-96c0-14a9bc144c93/overview

Verdict:

Malicious

Labled as:

Trojan.Downloader

Link:

https://www.hybrid-analysis.com/sample/1434ffad05e041b6b8fb3db75b0d2eb1772c6000d7265415eab71016eb463070

Verdict:

Malicious

File Type:

rar

First seen:

2025-11-05T02:19:00Z UTC

Last seen:

2025-11-05T11:01:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/1434ffad05e041b6b8fb3db75b0d2eb1772c6000d7265415eab71016eb463070/results?tab=lookup

Verdict:

Malware

YARA:

1 match(es)

Tags:

AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Rar Archive Suspect

Link:

https://app.malva.re/file/7e5f81d927dfdffea9d567e023ea1140

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1434ffad05e041b6b8fb3db75b0d2eb1772c6000d7265415eab71016eb463070/

Threat name:

Script-AutoIt.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-11-05 15:28:17 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

18 of 23 (78.26%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cq2p7lif4ba3noh3hw3vwdjowf3syyaa24tfifpkw4ibn22ggbya._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan

Link:

https://tria.ge/reports/251105-tgyq1aas7g/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Formbook payload

Formbook

Formbook family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1434ffad05e041b6b8fb3db75b0d2eb1772c6000d7265415eab71016eb463070

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4 Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/