MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bf31de983be33ba7be87131513a7c4102766bda004768f481909c73482e5215. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 14

Intelligence 14 IOCs YARA 16 File information Comments

SHA256 hash:	2bf31de983be33ba7be87131513a7c4102766bda004768f481909c73482e5215
SHA3-384 hash:	9d371bd15d1764f76067acd7acf7e928f0ee5ecf93afa8806510d53e6b54fa08d5450ecfdd1bbe553d34956d5e1b9e39
SHA1 hash:	a1401c6af317d0bb1327fbe399774938b02b1970
MD5 hash:	5903e31b9081aada1713dba3db4b9251
humanhash:	neptune-maryland-california-three
File name:	2bf31de983be33ba7be87131513a7c4102766bda004768f481909c73482e5215
Download:	download sample
Signature	Formbook Create hunting rule
File size:	714'240 bytes
First seen:	2025-08-12 14:14:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ef471c0edf1877cd5a881a6a8bf647b9 (83 x Formbook, 33 x Loki, 31 x Loda)
ssdeep	12288:ZOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi6L1nV7qdrSxFpn9pXN8BurdIcFXJI:Zq5TfcdHj4fmbBnV7imxP9p+BYs
Threatray	2'732 similar samples on MalwareBazaar
TLSH	T1DBE42394B5E8C822E5553330D13A8FB00A74BA31DD897B9D639CF54EB87268358C7E2D
TrID	33.9% (.EXE) UPX compressed Win32 Executable (27066/9/6) 33.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 13.1% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.6% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter	adrian__luca
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

2bf31de983be33ba7be87131513a7c4102766bda004768f481909c73482e5215

Verdict:

No threats detected

Analysis date:

2025-08-12 17:28:44 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/ac740ede-9f0d-4d35-870f-302c28ce726e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/20573/

Detection(s):

SecuriteInfo.com.W32.Trojan.VORE-2106.1542.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689b4e3bfca70bd90e8f0aef

Tags:

virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Сreating synchronization primitives

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

autoit compiled-script fingerprint lolbin microsoft_visual_cc netsh packed packed packed threat upx

Link:

https://www.filescan.io/uploads/689b5bb79ef4d2ff7cf89ce4/reports/c719aa73-9d6c-4989-a9ae-d6233f7128c9/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/2bf31de983be33ba7be87131513a7c4102766bda004768f481909c73482e5215

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4f8ec4a8-3c6b-4451-b8ff-5aab80446753

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/2bf31de983be33ba7be87131513a7c4102766bda004768f481909c73482e5215

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2bf31de983be33ba7be87131513a7c4102766bda004768f481909c73482e5215/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-07-23 02:11:37 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

30 of 38 (78.95%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fpzr32mdxyz3u67ioeyvcot4iebhm262abdwr5ebscohgsbokikq._file

Verdict:

malicious

Label(s):

autoit

unc_loader_036

formbook

Formbook

3bda3fad1522f9a7f7cf6a32e7eebcf755164b4ad9bfd0e79540b38afa51c897

Formbook

3d1701e167eb96e3954192b0558be7a9bb6579216bdaa5f7d79c8680689e89a2

Formbook

6d0fd0602a1828ade98dfdbfff0be8c036ac514c978a620e4588509b694cc29d

Formbook

730872db6e9f0f2b1d4fa4a3ca763733a41203b7cb86193e4c656f3861776dcb

Formbook

78d58fd064baa0f1f174c4fd0d81aebadad571ea0feb60176793c4a06218f26d

Formbook

8340eb528d4150ab1b95b165a204017213f09775ac4e567a0d029266edd4038c

Formbook

8393b72386d26ce3ba3d0b0abc1f28589c099634bad87647808baee320a8269a

Formbook

a4eac1a2891f56f37dbc860c6b56e8cd8d59972cd7faaf643854cb8860ca3d29

Formbook

dd3ac840eb842bd93fbbdcfb116d5761afc1a46f75fcf255d370d2602426494f

Formbook

+ 2'722 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan upx

Link:

https://tria.ge/reports/250812-srp16sswcx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

Formbook payload

Formbook

Formbook family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/34e306b0-f14f-4573-810b-d3debde3b071

Unpacked files

SH256 hash:

2bf31de983be33ba7be87131513a7c4102766bda004768f481909c73482e5215

MD5 hash:

5903e31b9081aada1713dba3db4b9251

SHA1 hash:

a1401c6af317d0bb1327fbe399774938b02b1970

Link:

https://www.unpac.me/results/6939c53d-c272-41e3-8a04-c743ccacbd55/

SH256 hash:

02077f4fe8a31f68111234524dbd4a8bafa0c52acc6f48b975ac9b68e23c43be

MD5 hash:

17c848215ea6def9d256830f3c3cf3ee

SHA1 hash:

6d32cbf595c968fb07822774453d21265e476ea5

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/6939c53d-c272-41e3-8a04-c743ccacbd55/

Parent samples :

f93e0a8edc73edfe87b73735f8530375d26ccfc916c77a1cca7d20e864b90320
cf6865fc7ac88881c24f2d6276c1898381ab11cefedca177eab385c4d9677149
2bf31de983be33ba7be87131513a7c4102766bda004768f481909c73482e5215
0effaf0dc6d8088a7a68bef26965aefc800665de5ab48a1ee70c482a6aeb79c5
b33b1499b2e2e5d5704d4d32bd1ccfbe345017dcb68f7392d6ef354207633235
0bbf77b0b55e802fad02e1d36fa5293ddc2860d187b35e61e0b51998f46a2312

SH256 hash:

179cf56125cd757f72b36f99435039d05bb9dbd8858c4bac852e5db6fb7aa968

MD5 hash:

546afc65e5ee1bce4c119705b5d738a6

SHA1 hash:

79d50332561778f04d377f52e21655c7c3e65ea3

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/6939c53d-c272-41e3-8a04-c743ccacbd55/

SH256 hash:

a96b00b201ff4766047e0abbd20f909d200b37fe3d9affc8a2f940fcf8818688

MD5 hash:

cbb310660c463cfcff2c0c9c7c261898

SHA1 hash:

a156d08bae8656c555c6c8c0c58985e8040ccfc0

Link:

https://www.unpac.me/results/6939c53d-c272-41e3-8a04-c743ccacbd55/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/20573/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::timeGetTime
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAce
WIN_BASE_API	Uses Win Base API	KERNEL32.DLL::LoadLibraryA
WIN_NETWORK_API	Supports Windows Networking	MPR.dll::WNetUseConnectionW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample