MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d9aae7952fca2b91194e5eee2003838305078a267ddf782bb1354446e23d33e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 10

Intelligence 10 IOCs YARA 19 File information Comments

SHA256 hash:	3d9aae7952fca2b91194e5eee2003838305078a267ddf782bb1354446e23d33e
SHA3-384 hash:	2c6396495d9ce38ff5f64408a4371203fc2986516fe610e9022fdafa4d73cee093389873bc6291186d6f99fb1afc5f19
SHA1 hash:	5e06d615085a72bd60ab4a9fcd5a8df107c8443e
MD5 hash:	d648b575255c6b79086c710ef1db88ef
humanhash:	sierra-juliet-lake-blue
File name:	Remittance Advice.zip
Download:	download sample
Signature	Formbook Create hunting rule
File size:	729'542 bytes
First seen:	2025-11-20 08:13:55 UTC
Last seen:	2025-11-20 08:14:11 UTC
File type:	zip
MIME type:	application/zip
ssdeep	12288:wp0C5sa8n6nx+atZrfIXm7ZW3kwtBVlxyjmwiWqSnS/0R6cEidgYTqu/x:wuCua86XDIXm7Z2kwpbREzytuukjx
TLSH	T1E4F4235B8EDE907BC5C05388C7F4164E88BD8BF7464E58A23E9D564EB2D2B4C0F8C529
Magika	zip
Reporter	cocaman
Tags:	FormBook zip

cocaman

Malicious email (T1566.001)
From: ""Witold Hoffmann Seacraft" <witold.hoffmann@seacraft.eu>" (likely spoofed)
Received: "from seacraft.eu (unknown [192.227.128.185]) "
Date: "20 Nov 2025 08:06:14 +0100"
Subject: "Follow up remittance advice "
Attachment: "Remittance Advice.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

100

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Remittance Advice.exe
File size:	1'167'360 bytes
SHA256 hash:	dbd4d458efddc920806baa4184cfa0aaf0b301b85d62c92b09f751d3f4f74b70
MD5 hash:	7a2790335597af11629ef4c43cbbfad0
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=691ecde38cf6736ec0af9a79

Tags:

autoit emotet

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/3d9aae7952fca2b91194e5eee2003838305078a267ddf782bb1354446e23d33e/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script fingerprint keylogger microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/691ecddec0cead54cd721165/reports/d68b145a-515b-4245-9b35-4dc7190f9c95/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3d9aae7952fca2b91194e5eee2003838305078a267ddf782bb1354446e23d33e

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/3d9aae7952fca2b91194e5eee2003838305078a267ddf782bb1354446e23d33e

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

File Type:

zip

First seen:

2025-11-19T11:02:00Z UTC

Last seen:

2025-11-20T21:19:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/3d9aae7952fca2b91194e5eee2003838305078a267ddf782bb1354446e23d33e/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/251120-kbjv8awrck/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/3d9aae7952fca2b91194e5eee2003838305078a267ddf782bb1354446e23d33e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Formbook Create hunting rule
Author:	kevoreilly
Description:	Formbook Payload

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/