MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b775e69fb52f4b7ce851072dde921977146de7dfe569a5609313387cac8a048. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 15

Intelligence 15 IOCs YARA 2 File information Comments

SHA256 hash:	2b775e69fb52f4b7ce851072dde921977146de7dfe569a5609313387cac8a048
SHA3-384 hash:	3c41f0a61776542fc8a5f5850bf1efc538651bc18575877df8598fedece9429f4dfc9877a984919c6766682f104578aa
SHA1 hash:	41ed9f602134b086e9c728b55b7251d40409d4e8
MD5 hash:	4aa74f9f8b2021cbb223526be653fe5e
humanhash:	maine-papa-virginia-iowa
File name:	dstq.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	287'744 bytes
First seen:	2026-06-30 08:17:08 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	6144:DTHeF1ynjrM9w7wlOafx/jlKZjy0I5EKZMOXQ:PHegjb7kfxRKZjy0mjdg
Threatray	2'931 similar samples on MalwareBazaar
TLSH	T16154231C02E1E2CDEC541AF0A4CAF8A33F9BDB1462EC185B3794AF6961B53953B5434B
Magika	pebin
Reporter	JAMESWT_WT
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

158

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

giaccagliag_INVOICE_84849850958_PDF.js

Verdict:

Malicious activity

Analysis date:

2026-06-30 08:15:14 UTC

Tags:

hanghost loader stego crypter pawsrunner

Link:

https://app.any.run/tasks/6da77fcf-5e83-4a47-ba53-76706ed5058b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/72463/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a437ba01548daf709fb38d9

Tags:

shellcode virus

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

formbook microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/6a437b9a45d4f71dff4d01fb/reports/e7a723ff-1cc9-4bcd-a1aa-edbef61a9614/overview

Verdict:

Malicious

Labled as:

FormBook.Generic

Link:

https://www.hybrid-analysis.com/sample/2b775e69fb52f4b7ce851072dde921977146de7dfe569a5609313387cac8a048

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-06-26T13:56:00Z UTC

Last seen:

2026-06-30T11:05:00Z UTC

Hits:

~100

Detections:

Trojan-Spy.Noon.HTTP.ServerRequest Backdoor.Agent.HTTP.C&C Trojan-Spy.Win32.Noon.sb Trojan-Spy.Win32.Noon.brxz

Link:

https://opentip.kaspersky.com/2b775e69fb52f4b7ce851072dde921977146de7dfe569a5609313387cac8a048/results?tab=lookup

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/de9bf6dc-7084-4161-9430-7e46857ea733

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/2b775e69fb52f4b7ce851072dde921977146de7dfe569a5609313387cac8a048

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2b775e69fb52f4b7ce851072dde921977146de7dfe569a5609313387cac8a048/

Verdict:

Malicious

Threat:

Trojan-Spy.Win32.Noon

Link:

https://tip.neiki.dev/file/2b775e69fb52f4b7ce851072dde921977146de7dfe569a5609313387cac8a048

Threat name:

Win32.Backdoor.FormBook

Status:

Malicious

First seen:

2026-06-29 06:25:14 UTC

File Type:

PE (Exe)

AV detection:

28 of 36 (77.78%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fn3v42p3kl2lptufcbzn32jbs5yunxt57zljuvqjgezypswiubea._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan

Link:

https://tria.ge/reports/260630-j6y3ysax4x/

Behaviour

Suspicious behavior: EnumeratesProcesses

System Location Discovery: System Language Discovery

Family: Formbook

Formbook payload

Unpacked files

SH256 hash:

2b775e69fb52f4b7ce851072dde921977146de7dfe569a5609313387cac8a048

MD5 hash:

4aa74f9f8b2021cbb223526be653fe5e

SHA1 hash:

41ed9f602134b086e9c728b55b7251d40409d4e8

Link:

https://www.unpac.me/results/93b4d793-9f24-4802-aad5-503b86842adf/

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2b775e69fb52/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.34

Link:

https://yomi.yoroi.company/submissions/2b775e69fb52f4b7ce851072dde921977146de7dfe569a5609313387cac8a048

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

exe 2b775e69fb52f4b7ce851072dde921977146de7dfe569a5609313387cac8a048

(this sample)

Cape

https://www.capesandbox.com/analysis/72463/

URLhaus

https://urlhaus.abuse.ch/url/3878545/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample