MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ae0a2cd16d28c901456b5ad1640c4dbb2005372742d552e1fbc076811ddccbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ae0a2cd16d28c901456b5ad1640c4dbb2005372742d552e1fbc076811ddccbf
SHA3-384 hash: 849d979da3516b6cde33d6fadb30e60b9100c42b01593f68bef3c9eaa0ba6df41a78cda6100db565642500f53b077145
SHA1 hash: a6735d82f674d667a72fd91eecbb8149267bd17c
MD5 hash: 069a2c7e0b5bc2c16f000abb70805685
humanhash: july-beer-pluto-kitten
File name:Copia di Attachment to MOM_270526_xls.vbs
Download: download sample
Signature Formbook
Create hunting rule
File size:357'936 bytes
First seen:2026-06-15 17:05:33 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 6144:+3FwaynOzf7fyAOjZutNeYxplB+8kSguDfcHoMrlVgbT:UFwayOzfDyAiZCxxplB+iNfcHoMrfi
Threatray 3'000 similar samples on MalwareBazaar
TLSH T1AA744A243DFA902A7173EF558FD8B9A6DA6FB7B33706545D1090034A0B13A81EDD263E
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika vba
Reporter abuse_ch
Tags:FormBook vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/70856/
Detection(s):
SecuriteInfo.com.VBS.Agent-107.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a303101a15110463ee619a6
Tags:
n/a
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade obfuscated
Link:
https://www.filescan.io/uploads/6a3030e8554e843ff86c39d7/reports/3cb9e793-f6fd-4a94-a791-9c359cdfbf93/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/3ae0a2cd16d28c901456b5ad1640c4dbb2005372742d552e1fbc076811ddccbf
Verdict:
Malicious
File Type:
vbs
First seen:
2026-06-15T09:03:00Z UTC
Last seen:
2026-06-15T13:55:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/3ae0a2cd16d28c901456b5ad1640c4dbb2005372742d552e1fbc076811ddccbf/results?tab=lookup
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1928247
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an undocumented autostart registry key
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Powershell scriptblock execution from environment variable
Queues an APC in another process (thread injection)
Sigma detected: Suspect Svchost Activity
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1928247 Sample: Copia di Attachment to MOM_... Startdate: 15/06/2026 Architecture: WINDOWS Score: 100 43 www.tenshoku-tokushu.click 2->43 45 www.oy1db.cn 2->45 47 8 other IPs or domains 2->47 59 Suricata IDS alerts for network traffic 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 Antivirus detection for dropped file 2->63 65 7 other signatures 2->65 12 wscript.exe 1 2->12         started        15 svchost.exe 1 1 2->15         started        signatures3 process4 dnsIp5 77 VBScript performs obfuscated calls to suspicious functions 12->77 79 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->79 81 Suspicious execution chain found 12->81 83 2 other signatures 12->83 18 conhost.exe 12->18         started        57 127.0.0.1 unknown unknown 15->57 signatures6 process7 process8 20 powershell.exe 15 18 18->20         started        dnsIp9 55 voltejeasteis.click 185.221.216.117, 443, 49703 HOST4GEEKS-LLC-Host4GeeksLLCUS United Kingdom 20->55 39 ControllingCountry...vbs:Zone.Identifier, ASCII 20->39 dropped 41 C:\...\ControllingCountrywideMediated.vbs, Unicode 20->41 dropped 67 Creates an undocumented autostart registry key 20->67 69 Writes to foreign memory regions 20->69 71 Injects a PE file into a foreign processes 20->71 25 svchost.exe 20->25         started        file10 signatures11 process12 signatures13 73 Maps a DLL or memory area into another process 25->73 75 Unusual module load detection (module proxying) 25->75 28 wKDqbmOPTZQRuP.exe 25->28 injected process14 signatures15 85 Maps a DLL or memory area into another process 28->85 31 mcbuilder.exe 13 28->31         started        process16 signatures17 87 Tries to steal Mail credentials (via file / registry access) 31->87 89 Tries to harvest and steal browser information (history, passwords, etc) 31->89 91 Modifies the context of a thread in another process (thread injection) 31->91 93 4 other signatures 31->93 34 xQak7nucmPu0.exe 31->34 injected 37 firefox.exe 31->37         started        process18 dnsIp19 49 www.tenshoku-tokushu.click 85.131.209.71, 49715, 49717, 49718 XSERVERXserverIncJP Japan 34->49 51 www.basilando.ch 192.250.229.161, 49720, 49721, 49722 WHG-FRAGB Germany 34->51 53 5 other IPs or domains 34->53
Score:
90%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3ae0a2cd16d28c901456b5ad1640c4dbb2005372742d552e1fbc076811ddccbf
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ae0a2cd16d28c901456b5ad1640c4dbb2005372742d552e1fbc076811ddccbf/
Verdict:
Malicious
Threat:
Trojan-Spy.Win32.Noon
Link:
https://tip.neiki.dev/file/3ae0a2cd16d28c901456b5ad1640c4dbb2005372742d552e1fbc076811ddccbf
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hlqkftiw2kgjafcwwwwrmqge3ozaau3soqwvklq7xqdwqeo5zs7q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
09a6d54e4d535c003a27d3e3501f13cb6758fab0d17285ebe7928571e82538ea
Formbook
18d7464b635f059c8792b3b2fb572ab348b9fca133ab0564fcde1a3d7beb1bba
Formbook
3ed39ee940874cdd45d49c41d2408f6aac20d9fbc10fe1d97f3e1d60983987a9
Formbook
60cda0957c7f3d24ef21a92a6f1bd57f791726b8f2e39ab732066bc99f565f4e
Formbook
86226b8c291f202ae6d8ef819e46339998ad4a5c797e1901af64ad9f4c20e735
Formbook
add86e84bb76decd85081877dda2189383abf10ffe0d4f9567c41e983dff0f34
Formbook
af3a25f876e1685971b8afcff0f49d0eac035f096255bc54c4e09677f89898d3
Formbook
bc5c060f306d5218716dfdc6ded8091d5f5306b91c63cc0cdf760b41a99108c9
Formbook
d6e65a981bbaa6dbce36e07c076654da474542b180c06f2fa0d41a76c093fb1e
Formbook
error
Formbook
f61680c5c6a002afd35dda833be1cb419c0aa284082d9dbfa95d3d704186d074
Formbook
+ 2'990 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution persistence
Link:
https://tria.ge/reports/260615-vl9jqsfy3m/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Registers new Windows logon scripts automatically executed at logon.
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3ae0a2cd16d28c901456b5ad1640c4dbb2005372742d552e1fbc076811ddccbf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RSharedStrings
Create hunting rule
Author:Katie Kleemola
Description:identifiers for remote and gmremote

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/70856/

Comments