MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 460a3b2167fa49635df79402ce12a300779e22e4e5a592bdab9824c64c3494d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 18


Intelligence 18 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 460a3b2167fa49635df79402ce12a300779e22e4e5a592bdab9824c64c3494d2
SHA3-384 hash: 3573d4cabb6673d73c1c11c03392cd716f4e9ddfda02ad8bbaf645a27fdeb97d55f9e98610f19355b8df09e0b8f037d3
SHA1 hash: d619bb2cbde35e475807c6a99e5d96fc00cfa00a
MD5 hash: b37c6f1fdb2def9c70dfd8a36daf4553
humanhash: triple-fifteen-equal-violet
File name:SecuriteInfo.com.Win32.MalwareX-gen.1484533916
Download: download sample
Signature Formbook
Create hunting rule
File size:788'480 bytes
First seen:2025-07-31 06:17:53 UTC
Last seen:2025-07-31 07:16:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'795 x AgentTesla, 19'693 x Formbook, 12'274 x SnakeKeylogger)
ssdeep 24576:qYKBzkhf3cVYPmBYttUMUZWXYfRd0rGIH0:YBQhfsjcURWXY5d5H
TLSH T1C9F4E00066B99B02D8A797F04570E0B103F87EAEA920E30E8DE57DDB7774F905A85793
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon d8d8dadad9d999d8 (8 x Formbook, 4 x AgentTesla, 3 x SnakeKeylogger)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
71
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.MalwareX-gen.1484533916
Verdict:
Malicious activity
Analysis date:
2025-07-31 06:21:18 UTC
Tags:
formbook xloader
Link:
https://app.any.run/tasks/f1c8c0fd-a4dc-4f21-877a-1a2269f5af39

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/17910/
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=688b0ab90b4775fb2133cfdd
Tags:
virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 bitmap fingerprint lolbin msbuild obfuscated packed packed reconnaissance regsvcs rezer0 roboski schtasks stego vbc zero
Link:
https://www.filescan.io/uploads/688b0ab013488cfd44e1f310/reports/9e33bb02-5af7-4822-809f-d4e665a15b76/overview
Verdict:
Malicious
Labled as:
Trojan.MSIL.Basic.5
Link:
https://www.hybrid-analysis.com/sample/460a3b2167fa49635df79402ce12a300779e22e4e5a592bdab9824c64c3494d2
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4c88f561-ef88-46ea-9bd4-a896839dd82f
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/460a3b2167fa49635df79402ce12a300779e22e4e5a592bdab9824c64c3494d2
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable PDB Path PE (Portable Executable) SOS: 0.39 Win 32 Exe x86
Link:
https://app.malva.re/file/b37c6f1fdb2def9c70dfd8a36daf4553
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/460a3b2167fa49635df79402ce12a300779e22e4e5a592bdab9824c64c3494d2/
Threat name:
ByteCode-MSIL.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-07-31 05:14:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iyfdwilh7jewgxpxsqbm4evdab3z4ixe4wszfpnltasmmtbustja._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
error
Formbook
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/250731-g2txbscl5s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/af36b0d9-d1df-4890-8131-4f507c5149b5
Unpacked files
SH256 hash:
460a3b2167fa49635df79402ce12a300779e22e4e5a592bdab9824c64c3494d2
MD5 hash:
b37c6f1fdb2def9c70dfd8a36daf4553
SHA1 hash:
d619bb2cbde35e475807c6a99e5d96fc00cfa00a
Link:
https://www.unpac.me/results/cd0344f5-0cad-440d-a3da-34cbd8987574/
SH256 hash:
194eaf4630ad0dc2c6a01fa2e0c2c891d80c737847393dfc0a9db490b8f6ccfa
MD5 hash:
8032570f82f7741316492c02d1a29a43
SHA1 hash:
501f5cfff95af3025b220b6f43fc85c88fd88b10
Link:
https://www.unpac.me/results/cd0344f5-0cad-440d-a3da-34cbd8987574/
SH256 hash:
622e7f4d998ec36f60da081aee7d66e7723730b68d5d7746eb9bc5c658e3e127
MD5 hash:
4c58c421863de090f1402822b3f68518
SHA1 hash:
b73dd9335ba38b0e91c0eacb178274a9938c8334
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/cd0344f5-0cad-440d-a3da-34cbd8987574/
SH256 hash:
6005f0e4563fef5e8abfdb88cacd5b3d8fd4cff04b1af93e8e01a9990f46d5c0
MD5 hash:
3f17ed370489371093c2a3d768cb6b07
SHA1 hash:
fb4f0ddcaf872e4c7850e4cefad59a2c62f54424
Link:
https://www.unpac.me/results/cd0344f5-0cad-440d-a3da-34cbd8987574/
SH256 hash:
ef1ad6b633fc57457c5996af72d20837273b9f4a20fd144d01605bcb216a7d98
MD5 hash:
0cd5f36688ec8bb0f1311a10824c9ccd
SHA1 hash:
dfd63ec59ea077d12fca03c19a6d358b7a74f5f3
Link:
https://www.unpac.me/results/cd0344f5-0cad-440d-a3da-34cbd8987574/
SH256 hash:
19d9497f6e745f4da576e009a620febd11dfa0b579273e2b9e0017f970a1d5da
MD5 hash:
bce826c010dbfe67e95ff9fb419e2784
SHA1 hash:
b02cebea760c0bd606ed5315242c43e7289b5657
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/cd0344f5-0cad-440d-a3da-34cbd8987574/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/460a3b2167fa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/460a3b2167fa49635df79402ce12a300779e22e4e5a592bdab9824c64c3494d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/17910/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments