MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3782826dd5afa9906218105d1d1db619182a7ae9b0e67c0f15340e6ef8194df2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 55 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3782826dd5afa9906218105d1d1db619182a7ae9b0e67c0f15340e6ef8194df2
SHA3-384 hash: 49860e7ada45e97409f131183678cbd4519b636a59d6870017aaf9e17d263f1e58f9fed00ce67e9bea05896bec2ad825
SHA1 hash: 3827eb4e93d658ecda8fbd805cbb0bfb29fd6c86
MD5 hash: 589389ec29fe4cdf38d79df2d1337e14
humanhash: bluebird-neptune-mars-carbon
File name:VESSEL Q88 INFORMATION.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:1'564'045 bytes
First seen:2025-12-18 11:27:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:RiiDK2NEG/WoHYuqvT24glrRpfmsIMMtBFrBqvpZ5AtSaoAjqgmKeZA/B89hm5+y:RiinNgoMK9HmVNfXqn+S8pYZjz9VG
TLSH T11C7533BB3E6C648C1A436610E0AA16C9C41D1185D5EA13BCF9C2B356F5B08FFF1586FA
Magika zip
Reporter cocaman
Tags:FormBook zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Dooyang Limited, Seoul <gibson@dooyang.com>" (likely spoofed)
Received: "from [77.83.39.65] (unknown [77.83.39.65]) "
Date: "18 Dec 2025 03:26:35 -0800"
Subject: "MV DOOYANG TBN - PORT INFO FOR DISCH 55,000MT OF COAL AT CHITTAGONG OR CHITTAGONG+PAYRA, BANGLADESH"
Attachment: "VESSEL Q88 INFORMATION.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
CH CH
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:VESSEL Q88 INFORMATION.exe
File size:1'555'536 bytes
SHA256 hash: 501c9eb3f5d3f10a337c3e6d3d1109635afd193cb012f78a093bd43307ef1009
MD5 hash: aa935f5f935f702d34cb7c975aa159d0
MIME type:application/x-dosexec
Signature Formbook
File name:msedge_elf.dll
File size:1'410'560 bytes
SHA256 hash: 0d2d887adcdf6309c4532e75ddb508db33402c7a488c3e2b8943c6721dab6708
MD5 hash: 82f08a330f0ed7e3178fbf81eeaa18b5
MIME type:application/x-dosexec
Signature Formbook
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/ff241af8-4f8a-4ae1-80c1-8c2f8eb883f1/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6943c1edc97f4a807a3b9d6c
Tags:
malware
Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/3782826dd5afa9906218105d1d1db619182a7ae9b0e67c0f15340e6ef8194df2/results/dashboard
Verdict:
Unknown
Threat level:
n/a  -.1.0/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm explorer fingerprint lolbin microsoft_visual_cc signed
Link:
https://www.filescan.io/uploads/6943e54ee126b9ff4386cf1e/reports/b5722567-993c-4e26-8f7f-95ffce30d016/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/3782826dd5afa9906218105d1d1db619182a7ae9b0e67c0f15340e6ef8194df2
Result
Verdict:
SUSPICIOUS
Link:
https://labs.inquest.net/dfi/sha256/3782826dd5afa9906218105d1d1db619182a7ae9b0e67c0f15340e6ef8194df2
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
File Type:
zip
First seen:
2025-12-18T06:59:00Z UTC
Last seen:
2025-12-20T02:57:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/3782826dd5afa9906218105d1d1db619182a7ae9b0e67c0f15340e6ef8194df2/results?tab=lookup
Score:
92%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/3782826dd5afa9906218105d1d1db619182a7ae9b0e67c0f15340e6ef8194df2
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Zip Archive
Link:
https://app.malva.re/file/589389ec29fe4cdf38d79df2d1337e14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3782826dd5afa9906218105d1d1db619182a7ae9b0e67c0f15340e6ef8194df2/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-12-18 08:35:39 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g6bie3ovv6uzayqycbor2hnwdemcu6xjwdthydyvgqhg56azjxza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/3782826dd5afa9906218105d1d1db619182a7ae9b0e67c0f15340e6ef8194df2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:Formbook
Create hunting rule
Author:kevoreilly
Description:Formbook Payload
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HUNTING_SUSP_TLS_SECTION
Create hunting rule
Author:chaosphere
Description:Detect PE files with .tls section that can be used for anti-debugging
Reference:Practical Malware Analysis - Chapter 16
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_Win_ETW_Bypass_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Windows ETW Bypass Detection Rule - 2025
Reference:https://cyfare.net/
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 3782826dd5afa9906218105d1d1db619182a7ae9b0e67c0f15340e6ef8194df2

(this sample)

Executable exe 501c9eb3f5d3f10a337c3e6d3d1109635afd193cb012f78a093bd43307ef1009

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 501c9eb3f5d3f10a337c3e6d3d1109635afd193cb012f78a093bd43307ef1009
  
Dropping
SHA256 0d2d887adcdf6309c4532e75ddb508db33402c7a488c3e2b8943c6721dab6708
  
Dropping
Formbook
  
Dropping
MD5 82f08a330f0ed7e3178fbf81eeaa18b5

Comments