MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20cdcfc958897b318418dce7c7f6308e3481731f09fac0772d0fd27d4e66e528. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 29 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20cdcfc958897b318418dce7c7f6308e3481731f09fac0772d0fd27d4e66e528
SHA3-384 hash: 1ad8145a9d469347034c6f96dbf1a364e0c7948a83311bb11fe8028a3fefda46cb5d86acb61ea6f9a615278d535fde1c
SHA1 hash: 9a3b226cfa0779946211730a3b2099c0e02bb332
MD5 hash: 7ad4e09741ed2bee5735319598f78945
humanhash: kentucky-cola-nitrogen-item
File name:DHL_AWB#6078538091.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:854'528 bytes
First seen:2026-08-03 11:22:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'192 x AgentTesla, 20'344 x Formbook, 12'365 x SnakeKeylogger)
ssdeep 12288:+sFXqBNPEKt10ka9f4/cMCayYP6GNZsQtgzpqjdvs+thwKObjslZuYy1Rl+H1I:+sCNOk+bMCayAldUMjdHhwLbjiuDf+
TLSH T13B05F04077BB2F56D27D93F1D652682063B6652F6124E70B0FE220E63E66BC489D0F93
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter TomU
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
DeepSea FormBook RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/36fa4565-cbc4-4da0-b4c5-16958fc987a4/
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/78658/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Launching a process
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade obfuscated packed
Link:
https://www.filescan.io/uploads/6a7081d118659ea951fec766/reports/f266506a-3ab8-45ae-8e35-7e947923390d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/20cdcfc958897b318418dce7c7f6308e3481731f09fac0772d0fd27d4e66e528
Verdict:
Malicious
File Type:
exe x32
First seen:
2024-03-01T01:39:00Z UTC
Last seen:
2026-07-31T19:07:00Z UTC
Hits:
~10000
Link:
https://opentip.kaspersky.com/20cdcfc958897b318418dce7c7f6308e3481731f09fac0772d0fd27d4e66e528/results?tab=lookup
Malware family:
KeyBase
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f50f8e01-41cd-430b-a0ae-cec7314507d4
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/20cdcfc958897b318418dce7c7f6308e3481731f09fac0772d0fd27d4e66e528
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.39 Win 32 Exe x86
Link:
https://app.malva.re/file/7ad4e09741ed2bee5735319598f78945
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20cdcfc958897b318418dce7c7f6308e3481731f09fac0772d0fd27d4e66e528/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2024-03-01 04:45:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
25 of 36 (69.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=edg47skyrf5tdbay3tt4p5rqry2ic4y7bh5ma5znb7jh2ttg4uua._file
Verdict:
malicious
Label(s):
Formbook
Create hunting rule
unc_loader_037
Create hunting rule
Link:
https://reports.threatray.com/b3587a18-9840-4b88-ab3a-660df54c930e
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook adware collection discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/260803-nhyjqshq3s/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
20cdcfc958897b318418dce7c7f6308e3481731f09fac0772d0fd27d4e66e528
MD5 hash:
7ad4e09741ed2bee5735319598f78945
SHA1 hash:
9a3b226cfa0779946211730a3b2099c0e02bb332
Link:
https://www.unpac.me/results/f2cf893a-3e6a-4811-af05-662462094a88/
SH256 hash:
d4e9623277d53f4118c37e2957fc7cc2355b58ff45cd78489a5b06bf9bad2665
MD5 hash:
eac170b887631f6c40a1cb48aa625b1f
SHA1 hash:
02e8ab0307850aaf41a6af789c0611e82bb22a2b
Link:
https://www.unpac.me/results/f2cf893a-3e6a-4811-af05-662462094a88/
SH256 hash:
95fb0011ca791fb15ac04b6912d300f460b97b4f34f34828133927e8b79faf67
MD5 hash:
a845e5310a24b6f606b267e085d275cb
SHA1 hash:
4480c495a2b1f6e88fd9acd3af0afcff5395a2cb
Link:
https://www.unpac.me/results/f2cf893a-3e6a-4811-af05-662462094a88/
SH256 hash:
b29a70d730f184338c7a9e20867eaccab01394e984d144212e726055b0c1f1f8
MD5 hash:
2084521bda851981abcf5b7010e0ae5b
SHA1 hash:
68b6852e411b13f8f658ac4ddc3621cc2c6ffd53
Link:
https://www.unpac.me/results/f2cf893a-3e6a-4811-af05-662462094a88/
SH256 hash:
4274bcec55cad35d52daffe54a07c0b3c330bdd898f111cbbc596ce1dc19f6b1
MD5 hash:
cca99e48fc61fa1f894a65f69a843ec0
SHA1 hash:
bd84254c1d0e04d5b5e94e9ca0777bf943254928
Link:
https://www.unpac.me/results/f2cf893a-3e6a-4811-af05-662462094a88/
SH256 hash:
bf6510a4e8362b5a59aeaf48825b205990faf5133ab22a38d402961826af9b76
MD5 hash:
d576188a4b57fbe1053ea7493d249260
SHA1 hash:
e8bc9477c4fd2dd1e4400edd4043ca6bf6ca3f18
Link:
https://www.unpac.me/results/f2cf893a-3e6a-4811-af05-662462094a88/
SH256 hash:
bf120163192ff5c11c38a442fcb67c729fadbc9d7ad403aa6b24ad96bcf3c6fc
MD5 hash:
a8df38d63d24bb5c50210c3e38e041e8
SHA1 hash:
f0ffb98cff345d3acf0e32ad63ee33630f8f9c14
Link:
https://www.unpac.me/results/f2cf893a-3e6a-4811-af05-662462094a88/
SH256 hash:
a1641e650531f49b704a7097303941766fbbbc355e96d9a38d37ee59fcfbf803
MD5 hash:
503070be34bb3b7304901df0c718a291
SHA1 hash:
1bfcaebc578fc50415b9c56e254cf7a412bd12d8
Link:
https://www.unpac.me/results/f2cf893a-3e6a-4811-af05-662462094a88/
SH256 hash:
579b472056397fd592d04da2a052dd0e05c650776815acbaa21d17396d3de662
MD5 hash:
7d5a3037583b65de4cb31ab4b17d444a
SHA1 hash:
8eef1505aa6cfe71b9d4cbd5f02965fc29ffb7aa
Link:
https://www.unpac.me/results/f2cf893a-3e6a-4811-af05-662462094a88/
SH256 hash:
72638f4b30cc9dab51d31216991957bf1cd118b8a8743227b3e8f9c4805f7628
MD5 hash:
2a8240bba06e832ee5d136a0a7e5b5b9
SHA1 hash:
de49d9b33004a4a622a4279b3ee2b3e3e5cd012b
Link:
https://www.unpac.me/results/f2cf893a-3e6a-4811-af05-662462094a88/
SH256 hash:
b3f2bcb08ae6ed77b51186dc73ac27afc31c9e3b175914fbc7e932a053024057
MD5 hash:
8edcf081ada9f28a2722afb40ac6e099
SHA1 hash:
9a1d6568a6063fccac7eef51a12cbdaa81b82262
Link:
https://www.unpac.me/results/f2cf893a-3e6a-4811-af05-662462094a88/
SH256 hash:
78d6d8fd9900196806296a6f6ba9f6ff821e69761284ed08e4d2cb5ba68d5edd
MD5 hash:
c911ccbfe23a3f3835377090673f24d9
SHA1 hash:
da26b2a0c791df1ba9c21953567ce992997ddb08
Detections:
win_formbook_w0
Create hunting rule
win_formbook_g0
Create hunting rule
XLoader
Create hunting rule
Link:
https://www.unpac.me/results/f2cf893a-3e6a-4811-af05-662462094a88/
Parent samples :
d80d15764111eb80aa6f43d95f3effa13eb47c43937a578d78692769953defc0
0b635b5bcfdf7f115415cd72598cb387441cb7d0fcd2ad3937737fc01c05ca5c
d7eab9eb726b311e97b0c71522363b9223f767f7474c5cbf4d9bf0df9c4b909d
1c74b93b1aa4aaccbef0f11ab5466e2bb801a284b4c5d2d94d9c010b00931763
99508e1f259485c8c1a9b8a6b60c2fa9355caabd41e6c78854252cfa397673b7
a6d4a7d43d4868e871e0caac0ac2cbaa742a1c0a2416ce70c43a5e1c418d4a64
20cdcfc958897b318418dce7c7f6308e3481731f09fac0772d0fd27d4e66e528
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/20cdcfc958897b318418dce7c7f6308e3481731f09fac0772d0fd27d4e66e528

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Formbook
Create hunting rule
Author:kevoreilly
Description:Formbook Payload
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Windows_Trojan_Formbook
Create hunting rule
Author:@malgamy12
Rule name:Windows_Trojan_Formbook_1112e116
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach
Rule name:win_formbook_w0
Create hunting rule
Author:@malgamy12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 20cdcfc958897b318418dce7c7f6308e3481731f09fac0772d0fd27d4e66e528

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/78658/

Comments