MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 432ba75638ad5983cdf489ee72b425185dd0c8ea746b3e329b30dca191561476. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 432ba75638ad5983cdf489ee72b425185dd0c8ea746b3e329b30dca191561476
SHA3-384 hash: 669fb6360722a258718177a9b5a4bb9ba4e3eb104e3a6b1e5bc2331335db9e6e8dd265d1fed00eb9c8cd702d86045695
SHA1 hash: 275bfd38d23faecd2a72efb68aa9434e68144576
MD5 hash: de7430772558fa34d2d4aa78a84602c7
humanhash: summer-orange-romeo-kitten
File name:Scanned File.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'293'312 bytes
First seen:2025-06-24 15:20:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b768923437678ce375719e30b21693e (143 x Formbook, 25 x MassLogger, 22 x SnakeKeylogger)
ssdeep 24576:15EmXFtKaL4/oFe5T9yyXYfP1ijXdaDUbdQoBKANCeLrEoItv:1PVt/LZeJbInQRaDUbdQKXCGIoI
Threatray 6 similar samples on MalwareBazaar
TLSH T11055CF0273D1C062FFAB91334B5AF6115BBD79260123A62F13981DB9BE701B1563E7A3
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
442
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Scanned File.exe
Verdict:
No threats detected
Analysis date:
2025-06-24 15:37:12 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/71801931-2a93-4bd4-a25a-a17a88ea7042

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10928/
Detection(s):
SecuriteInfo.com.Trojan.Inject5.58166.25055.5478.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=685ac46c32ed47a3a8d6baf7
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug autoit compiled-script entropy fingerprint keylogger microsoft_visual_cc packed packed packer_detected
Link:
https://www.filescan.io/uploads/685ac33966c4b5c0b99d9d93/reports/38b855dd-fa5e-44c3-b1c8-129b08d6be0f/overview
Verdict:
Malicious
Labled as:
Trojan.BAT.Agent.gen
Link:
https://www.hybrid-analysis.com/sample/432ba75638ad5983cdf489ee72b425185dd0c8ea746b3e329b30dca191561476
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/48da6d19-ff61-4293-8bc8-d7bfba0ed475
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1722011
Signature
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1722011 Sample: Scanned File.exe Startdate: 24/06/2025 Architecture: WINDOWS Score: 96 31 www.lopixa.xyz 2->31 33 www.trainedtalents.xyz 2->33 35 8 other IPs or domains 2->35 43 Multi AV Scanner detection for submitted file 2->43 45 Yara detected FormBook 2->45 47 Binary is likely a compiled AutoIt script file 2->47 51 2 other signatures 2->51 11 Scanned File.exe 2 2->11         started        signatures3 49 Performs DNS queries to domains with low reputation 33->49 process4 signatures5 61 Binary is likely a compiled AutoIt script file 11->61 63 Writes to foreign memory regions 11->63 65 Maps a DLL or memory area into another process 11->65 14 svchost.exe 11->14         started        process6 signatures7 67 Maps a DLL or memory area into another process 14->67 17 CnaAxYxhVwu2.exe 14->17 injected process8 process9 19 logman.exe 13 17->19         started        signatures10 53 Tries to steal Mail credentials (via file / registry access) 19->53 55 Tries to harvest and steal browser information (history, passwords, etc) 19->55 57 Modifies the context of a thread in another process (thread injection) 19->57 59 3 other signatures 19->59 22 vuyrJh80ksitU.exe 19->22 injected 25 chrome.exe 19->25         started        27 firefox.exe 19->27         started        process11 dnsIp12 37 www.lopixa.xyz 67.223.117.189, 49712, 49713, 49714 VIMRO-AS15189US United States 22->37 39 atelier-oiseaubleu.net 84.32.84.32, 49704, 49705, 49706 NTT-LT-ASLT Lithuania 22->39 41 3 other IPs or domains 22->41 29 WerFault.exe 4 25->29         started        process13
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/432ba75638ad5983cdf489ee72b425185dd0c8ea746b3e329b30dca191561476
Verdict:
Malware
YARA:
7 match(es)
Tags:
AutoIt Decompiled Executable PE (Portable Executable) Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/de7430772558fa34d2d4aa78a84602c7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/432ba75638ad5983cdf489ee72b425185dd0c8ea746b3e329b30dca191561476/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/432ba75638ad5983cdf489ee72b425185dd0c8ea746b3e329b30dca191561476
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=imv2ovryvvmyhtpurhxhfnbfdbo5bshkorvt4mu3gdokdekwcr3a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
432ba75638ad5983cdf489ee72b425185dd0c8ea746b3e329b30dca191561476
Formbook
7039cacccff280189a0abf06fecc5bd52ad7386fdc88b25a582a13a6eae02851
Formbook
7fcb6c7b8dec80d83856c7ada120a5ecd47bf61a54c2248c35d96115e1d66122
Formbook
835be5aeeff47a77edef5ad2b865daa408cb809ad1dc60e2c01e669dcfd2fda4
Formbook
b1ca66c8cc7404a8093a85dc99ba848d7b4b307e463dd930ec91c509e1e81df2
Formbook
error
Formbook
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/250624-ss7bvavyex/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5b330244-142e-4f2c-b468-e6d487a7b9a5
Unpacked files
SH256 hash:
f5c39d3ff91e3161079ba8095322585bafa3009e617948d72ad027baa8b0ef3b
MD5 hash:
21e4beaac529d65b562180923af85ba2
SHA1 hash:
cc68144f915710ba10151a8ecc45b24d49e01893
Link:
https://www.unpac.me/results/31271d8d-8883-4cd4-8ba3-3da6ff3134be/
SH256 hash:
ee076d1883a596044150f8bb7ffc838461c1b6aeca7e29f0d90bbecf37f6b2f7
MD5 hash:
755ce6bf3140bfc1ca1cdde3513b278a
SHA1 hash:
45f3b33dfd4bc389c601c262a9af7a545f2183e2
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/31271d8d-8883-4cd4-8ba3-3da6ff3134be/
Parent samples :
7039cacccff280189a0abf06fecc5bd52ad7386fdc88b25a582a13a6eae02851
e1ba1b9d4f186aa4cb943df579530e6d858bc23c252b81a34486773e761a3b9a
432ba75638ad5983cdf489ee72b425185dd0c8ea746b3e329b30dca191561476
f745db2b407ab57072397092b6354a1fafc1442753acf17119dd464595e5bdee
011b0f36f357ab20aa21d33a4f1b496c7eaf7d2580af285a694b5447fa62779e
1d256e48ad02938535032f73aac2a6a469f7f044c9aa6485a8813a1258b011d1
SH256 hash:
432ba75638ad5983cdf489ee72b425185dd0c8ea746b3e329b30dca191561476
MD5 hash:
de7430772558fa34d2d4aa78a84602c7
SHA1 hash:
275bfd38d23faecd2a72efb68aa9434e68144576
Link:
https://www.unpac.me/results/31271d8d-8883-4cd4-8ba3-3da6ff3134be/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/432ba75638ad/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/10928/

Comments