MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44eb0ca230176e7653e8287dac64b16e4cfde7088635498e52d802d8a3dcb7e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 20


Intelligence 20 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44eb0ca230176e7653e8287dac64b16e4cfde7088635498e52d802d8a3dcb7e9
SHA3-384 hash: 8de16f4e36e29092fd25409a982aeca7e1d42471f82d36ddecda3e465dba8c22357702a589a1bd010fdf431da0981126
SHA1 hash: 87be2359e353e2b6a3f8bda2da5c24e704d4f20e
MD5 hash: c2cd239bc23861e9a4bdaa53659d3715
humanhash: emma-wolfram-colorado-kilo
File name:purchase order.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:763'904 bytes
First seen:2025-10-14 06:38:43 UTC
Last seen:2025-10-14 13:12:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:lyj7iSEDzPFh6qKb2AjtiQUCiezBZC21w25qAtLYG/n7bnd5LtXqw8YiGqbdvnJq:Ij7iXPFh61KAjtixCisI2KmtU+71XqMj
TLSH T162F4029C3704D917C55657B80971F278236A4EE9F621D292BFEC2EAFB8B9F504C00786
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter cocaman
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
4
# of downloads :
109
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
purchase order.r15
Verdict:
Malicious activity
Analysis date:
2025-10-14 07:00:31 UTC
Tags:
arch-exec stealer formbook xloader
Link:
https://app.any.run/tasks/761f481f-cd4b-4424-ad73-3c7d7605c4de

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/32629/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68edf02b04e22ce9acd9c978
Tags:
virus spawn shell
Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/68edf034fe81c560ba586de7/reports/fe255f90-25a7-43f8-bf79-0f2a9e36b0c6/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/44eb0ca230176e7653e8287dac64b16e4cfde7088635498e52d802d8a3dcb7e9
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-13T22:45:00Z UTC
Last seen:
2025-10-16T04:10:00Z UTC
Hits:
~1000
Detections:
Trojan.MSIL.Taskun.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb PDM:Trojan.Win32.Generic Trojan-Spy.Win32.Noon.sb Trojan-Spy.Noon.HTTP.ServerRequest Trojan-PSW.Win32.Stealer.sb HEUR:Trojan.MSIL.Taskun.gen Backdoor.Agent.HTTP.C&C
Link:
https://opentip.kaspersky.com/44eb0ca230176e7653e8287dac64b16e4cfde7088635498e52d802d8a3dcb7e9/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c503e6ba-9d1c-4835-8247-635645ada56b
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1794497
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1794497 Sample: purchase order.exe Startdate: 14/10/2025 Architecture: WINDOWS Score: 100 33 www.yourcarrier.xyz 2->33 35 c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com 2->35 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected FormBook 2->41 43 Yara detected AntiVM3 2->43 47 5 other signatures 2->47 10 purchase order.exe 4 2->10         started        signatures3 45 Performs DNS queries to domains with low reputation 33->45 process4 file5 31 C:\Users\user\...\purchase order.exe.log, ASCII 10->31 dropped 57 Writes to foreign memory regions 10->57 59 Allocates memory in foreign processes 10->59 61 Adds a directory exclusion to Windows Defender 10->61 63 Injects a PE file into a foreign processes 10->63 14 MSBuild.exe 10->14         started        17 powershell.exe 23 10->17         started        signatures6 process7 signatures8 65 Maps a DLL or memory area into another process 14->65 19 GSBRYhVlr.exe 14->19 injected 67 Loading BitLocker PowerShell Module 17->67 21 conhost.exe 17->21         started        process9 process10 23 wlanext.exe 13 19->23         started        signatures11 49 Tries to steal Mail credentials (via file / registry access) 23->49 51 Tries to harvest and steal browser information (history, passwords, etc) 23->51 53 Maps a DLL or memory area into another process 23->53 55 2 other signatures 23->55 26 cl139ZIt.exe 23->26 injected 29 chrome.exe 23->29         started        process12 dnsIp13 37 www.yourcarrier.xyz 76.223.54.146, 49692, 80 AMAZON-02US United States 26->37
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.35 Win 32 Exe x86
Link:
https://app.malva.re/file/c2cd239bc23861e9a4bdaa53659d3715
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44eb0ca230176e7653e8287dac64b16e4cfde7088635498e52d802d8a3dcb7e9/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/44eb0ca230176e7653e8287dac64b16e4cfde7088635498e52d802d8a3dcb7e9
Threat name:
Win32.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2025-10-14 02:51:59 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=itvqzirqc5xhmu7ifb62yzfrnzgp3zyiqy2utdss3abnri64w7uq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
error
Formbook
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/251014-herdcses6a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ea7091ed-bfbb-4abe-82d0-6902d28de7a8
Unpacked files
SH256 hash:
44eb0ca230176e7653e8287dac64b16e4cfde7088635498e52d802d8a3dcb7e9
MD5 hash:
c2cd239bc23861e9a4bdaa53659d3715
SHA1 hash:
87be2359e353e2b6a3f8bda2da5c24e704d4f20e
Link:
https://www.unpac.me/results/e1225ee3-e75d-4409-aae1-58600280b382/
SH256 hash:
e1e606caa25ffb73a92e74c96757a0d2c73f1d63da460558b94595e28847bd1d
MD5 hash:
764f4362430a445a7b4217ebf6405634
SHA1 hash:
217dd3c85f925280c33f2c7285fe1e048c134ec5
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/e1225ee3-e75d-4409-aae1-58600280b382/
SH256 hash:
b794ed0c0c7d4499d0a2ffff67eb5b92dba83f4be7964591e9edad2755176511
MD5 hash:
2a576318d07470206dd7c45f7d896078
SHA1 hash:
3096b2a5ccd98583949a9f57842d5547b50bbc29
Link:
https://www.unpac.me/results/e1225ee3-e75d-4409-aae1-58600280b382/
SH256 hash:
f7b55edef63e49793f4bee5657464310562e2e5c9f4ad8d39764cc2bd4b8cbb1
MD5 hash:
666353f0798ebdf250512f14f7ce7a41
SHA1 hash:
8736db444e1c1a503b2f5346c6594b02584e5ddd
Link:
https://www.unpac.me/results/e1225ee3-e75d-4409-aae1-58600280b382/
SH256 hash:
fae3fe1a1c49b3df491ce0db82f943afa346ddd580e9f61eda913fcc1c5a5b82
MD5 hash:
c17512299a56fc64e23fa3e1b35699df
SHA1 hash:
a7faee9c891d2004594a4e76df9232ac6af96bb5
Link:
https://www.unpac.me/results/e1225ee3-e75d-4409-aae1-58600280b382/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/44eb0ca23017/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/44eb0ca230176e7653e8287dac64b16e4cfde7088635498e52d802d8a3dcb7e9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 2011d40774ea2dda0fe04b63119e31d0146f6ba6be1b9cdff11a3aaad33751b3

Formbook

Executable exe 44eb0ca230176e7653e8287dac64b16e4cfde7088635498e52d802d8a3dcb7e9

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 2011d40774ea2dda0fe04b63119e31d0146f6ba6be1b9cdff11a3aaad33751b3
Cape
Cape
https://www.capesandbox.com/analysis/32629/
  
Dropped by
MD5 b17d74af27b1387b187aee5e73528f0f

Comments