MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bfabcd7bd0dd5f3e9220b42c0457f89282ed0168d0f69d7b1af008c81d3ef2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 19


Intelligence 19 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bfabcd7bd0dd5f3e9220b42c0457f89282ed0168d0f69d7b1af008c81d3ef2b
SHA3-384 hash: 0ab2da90edda75f76ca91aeb340e98ebd4235b13da6dc28d62bd671606f671c38e821305ad1d8cf0d234f8e117cedfe6
SHA1 hash: fc2d32574de9d54a609c672762be1f21e1a1ba5f
MD5 hash: f06d93f0544a9b6cd440073bb212e7fb
humanhash: burger-washington-yankee-alpha
File name:PO 83607.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:742'912 bytes
First seen:2025-09-23 13:02:18 UTC
Last seen:2025-10-09 14:39:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 21371b611d91188d602926b15db6bd48 (60 x Formbook, 23 x AgentTesla, 20 x RemcosRAT)
ssdeep 12288:9z7hU5I5yuNHIgzSFKxWltRohBfSTso93UXvS1cwazbrmJqUhYfmygETWTzw:9f+iN57Gtene3UaKKg8qifw
Threatray 1'386 similar samples on MalwareBazaar
TLSH T1B0F4225298D098A1D65077308436CC64DA783D31AE49735E833DEABB68723C7FE92B1D
TrID 39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6)
38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
7.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.9% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
123
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO 83607.exe
Verdict:
No threats detected
Analysis date:
2025-09-23 13:06:09 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e71386a2-c363-4eee-bd41-d4f9110e58af

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/28656/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68d29a8ea8481b7a76abb9a6
Tags:
malware
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit cmd compiled-script evasive lolbin microsoft_visual_cc packed packed packed phishing schtasks upx
Link:
https://www.filescan.io/uploads/68d29ac205398d990aef99b4/reports/734897c3-6406-432f-accb-83557909fe8c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/1bfabcd7bd0dd5f3e9220b42c0457f89282ed0168d0f69d7b1af008c81d3ef2b
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-22T21:33:00Z UTC
Last seen:
2025-09-22T21:33:00Z UTC
Hits:
~1000
Detections:
Trojan.Win32.Zenpak.sb PDM:Trojan.Win32.Generic Trojan-Spy.Win32.Noon.sb Trojan-PSW.Win32.Stealer.sb Trojan.Win32.Strab.sb Trojan.Win32.Inject.sb HEUR:Trojan.Script.AUO.gen
Link:
https://opentip.kaspersky.com/1bfabcd7bd0dd5f3e9220b42c0457f89282ed0168d0f69d7b1af008c81d3ef2b/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/db0e3abb-b9eb-4430-81c9-0d741935dd50
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1bfabcd7bd0dd5f3e9220b42c0457f89282ed0168d0f69d7b1af008c81d3ef2b
Verdict:
Malware
YARA:
5 match(es)
Tags:
AutoIt Decompiled Executable PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/f06d93f0544a9b6cd440073bb212e7fb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1bfabcd7bd0dd5f3e9220b42c0457f89282ed0168d0f69d7b1af008c81d3ef2b/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/1bfabcd7bd0dd5f3e9220b42c0457f89282ed0168d0f69d7b1af008c81d3ef2b
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-09-23 04:10:09 UTC
File Type:
PE (Exe)
Extracted files:
52
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dp5lzv55bxk7h2jcbnbmarl7reuc5uawruhwtv5rv4aizaot54vq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0002a2f7d00d1d6c5289a0c6915c6a761145586b191c03d6ae9320ac487c9ed3
Formbook
025b8d79911d3b0384ee29386388a7b9815024baffacacab86c3f253ce89a9e5
Formbook
3103bad7a756dbde298af3162f848f2a3101354148fec4f4b341a7ce17adf4c5
Formbook
611800d260a261ca41759e9c79312cdabe2529bc8fe362f296b348c5fa1a5c09
Formbook
7bdfffe8dc720208f49a5e88ef7a2ef043c9af8a0995193b0cfe0b02dd5ab667
Formbook
82ba586870ddf21da64398098ac654ae92f389969087698b906d4efe54c6489c
Formbook
89298940d17702803fc97b47258c639f223ddebd6368a0d946647cb79acacc2e
Formbook
8c9fd9ea38c16b4b38039c60d03c499aff67451f6fcd00d56abd4c81a6f2c3c2
Formbook
cb4788741b2c7792c25c956a4c2dab349fed2e93c175cc79c112d6faf95ec8bd
Formbook
d6db45310338efda0778f101ea3378831370913796f5971fd861d9f2c3f49ef0
Formbook
error
Formbook
+ 1'376 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan upx
Link:
https://tria.ge/reports/250923-p98z8ayset/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Formbook payload
Formbook
Formbook family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/bd0f79c5-d1d6-4890-80f0-650fb5e1367a
Unpacked files
SH256 hash:
1bfabcd7bd0dd5f3e9220b42c0457f89282ed0168d0f69d7b1af008c81d3ef2b
MD5 hash:
f06d93f0544a9b6cd440073bb212e7fb
SHA1 hash:
fc2d32574de9d54a609c672762be1f21e1a1ba5f
Link:
https://www.unpac.me/results/c9606d5c-1976-4870-86c8-a942fc4bb7d2/
SH256 hash:
a0476d04bfa9a07567cdfb7a9864eb9702dcfb4cf9d41c44a90f6c3e9d8b93ed
MD5 hash:
ddff9c224e12f7424c5808c7a9eda3c6
SHA1 hash:
9448e4a8df7659fe77740646f8d1ed9f0db9491f
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/c9606d5c-1976-4870-86c8-a942fc4bb7d2/
SH256 hash:
f823e6e8ca9bd52588534ec40fa9ec2e7e9621e61783aa58a9ccc9dab49b8d85
MD5 hash:
1e52bc0a874392d7af97f59df70c8c3b
SHA1 hash:
202f6ae7d619fb0fd74cf2f6e0fcd54d89f1c0d3
Link:
https://www.unpac.me/results/c9606d5c-1976-4870-86c8-a942fc4bb7d2/
SH256 hash:
17840ca8ffcbe3156adc0c138364c41520b7098da7c243d435f4098d1d312fb7
MD5 hash:
8b7fdc208816d232060bd31168007331
SHA1 hash:
23925755639a7ae67957b99b93814f10b2cfcfca
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/c9606d5c-1976-4870-86c8-a942fc4bb7d2/
Parent samples :
82ba586870ddf21da64398098ac654ae92f389969087698b906d4efe54c6489c
025b8d79911d3b0384ee29386388a7b9815024baffacacab86c3f253ce89a9e5
cb4788741b2c7792c25c956a4c2dab349fed2e93c175cc79c112d6faf95ec8bd
3103bad7a756dbde298af3162f848f2a3101354148fec4f4b341a7ce17adf4c5
9adfb198a2170e61efe961e8459783ccf4f10639fdbcfea8639a4de54908b99e
580171625754b06d27df4dc5ceb6d2b8e7ca4586ad67e7796143fd35c03072d3
da96b245116b34d109d997d46e627c8971c726bf223db8ff9855cb4231ad1a26
1bfabcd7bd0dd5f3e9220b42c0457f89282ed0168d0f69d7b1af008c81d3ef2b
58b6d339685af19c4ff7e2743c6a4becb48b6ec76ce138ff1e77cffea80bea36
bbdc0a2fe3164b6eed253b28147b4dce703bf0b0dbe405a012b42e02bdf5af56
738269e624c70e9f0890f3e37d9b6685039158197139fd2785d1f1f380bf33f7
2f557cc03aa9c54def2dff216a1f8923c4c61de9178764b6252c0711aab498c8
b8d6d07599779b12bc291ab98b24bb8da4a94c08a87a0031829764a6db0a3918
87e71f3ca2dfb03fba86134301f3f5d8e0001b6e2668b37bdc6bbdb85fb82513
ee75983f41e1cbcb6571d23f4753b6c361707331e1de552a1c5a6635ff285f4b
894e9f099128c88722bfd2895844097bdf1954b5111ff3c53c5caba3d4ba293c
668c1f290c086d51456b3140d33615a6e9fdcaba766966349a4fe33fd37263d6
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1bfabcd7bd0d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1bfabcd7bd0dd5f3e9220b42c0457f89282ed0168d0f69d7b1af008c81d3ef2b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/28656/

Comments