MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 479ca9e4974c18451cc33514037e524b1e04aea73d7ea1e2cec19ae5d443bb5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 479ca9e4974c18451cc33514037e524b1e04aea73d7ea1e2cec19ae5d443bb5d
SHA3-384 hash: 4b335cfa52b8009b36c8998da7627914e1fe540f839237390e21e531099d4dee954a74d697109125d6295a140936c598
SHA1 hash: 8ddd5fd4f8a85609786082755ed0900b7cf707e9
MD5 hash: 73f2176d6e5e406b2fab7993f914bad4
humanhash: bacon-nevada-beer-alabama
File name:new order.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'344'512 bytes
First seen:2026-02-10 17:52:56 UTC
Last seen:2026-02-10 18:16:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'818 x AgentTesla, 19'742 x Formbook, 12'286 x SnakeKeylogger)
ssdeep 24576:SguQmjPsixOCqc9zp01VfqrUiJWXt65F5mFUBC7GaHJqTQEbuUjVict:runTkCqc9l0D7XgYFUBC7GGAcEbtjQc
TLSH T1CF55235826DCCD67C0542BF408B2C37147B95E6AA413C22B8EDE9EFBBCA6BD05518347
TrID 35.4% (.EXE) Win64 Executable (generic) (10522/11/4)
22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.1% (.EXE) Win32 Executable (generic) (4504/4/1)
6.9% (.ICL) Windows Icons Library (generic) (2059/9)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
153
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/4c49dcc0-abbe-456c-b9c8-9a40c41de858/
Malware family:
formbook
Create hunting rule
ID:
1
File name:
neworder.r15
Verdict:
Malicious activity
Analysis date:
2026-02-10 14:11:35 UTC
Tags:
arch-exec auto-startup stealer formbook xloader
Link:
https://app.any.run/tasks/06f75f4a-3f74-49dc-a585-6088670dd736

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/52933/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=698b3c9542fd65534cce4848
Tags:
autorun micro shell spawn
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/479ca9e4974c18451cc33514037e524b1e04aea73d7ea1e2cec19ae5d443bb5d
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-02-10T03:55:00Z UTC
Last seen:
2026-02-12T15:43:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/479ca9e4974c18451cc33514037e524b1e04aea73d7ea1e2cec19ae5d443bb5d/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/e11e806d-ae51-40bb-abde-c3659b005285
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1866543
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses whoami command line tool to query computer and username
Windows shortcut file (LNK) contains suspicious command line arguments
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1866543 Sample: new order.exe Startdate: 10/02/2026 Architecture: WINDOWS Score: 100 53 www.vporn.com 2->53 55 www.tirnelovaxor.ru 2->55 57 23 other IPs or domains 2->57 75 Suricata IDS alerts for network traffic 2->75 77 Antivirus detection for URL or domain 2->77 79 Multi AV Scanner detection for submitted file 2->79 81 12 other signatures 2->81 11 new order.exe 7 2->11         started        15 powershell.exe 15 2->15         started        signatures3 process4 file5 47 C:\Users\user\AppData\...\qnyklWTXGAI.exe, PE32 11->47 dropped 49 C:\Users\...\qnyklWTXGAI.exe:Zone.Identifier, ASCII 11->49 dropped 51 C:\Users\user\AppData\...\new order.exe.log, ASCII 11->51 dropped 91 Adds a directory exclusion to Windows Defender 11->91 93 Injects a PE file into a foreign processes 11->93 17 new order.exe 11->17         started        20 powershell.exe 23 11->20         started        22 new order.exe 11->22         started        24 qnyklWTXGAI.exe 5 15->24         started        26 conhost.exe 1 15->26         started        signatures6 process7 signatures8 65 Maps a DLL or memory area into another process 17->65 28 5mHRjI7wDlLi.exe 17->28 injected 67 Loading BitLocker PowerShell Module 20->67 32 conhost.exe 20->32         started        69 Multi AV Scanner detection for dropped file 24->69 71 Injects a PE file into a foreign processes 24->71 73 Unusual module load detection (module proxying) 24->73 34 qnyklWTXGAI.exe 24->34         started        36 qnyklWTXGAI.exe 24->36         started        process9 dnsIp10 59 www.ponita.site 104.207.66.126, 49710, 49711, 49712 WINNE-IPV4-1US United States 28->59 61 www.avozr.ru 141.8.192.31, 49706, 49707, 49708 SPRINTHOSTRU Russian Federation 28->61 63 12 other IPs or domains 28->63 95 Uses whoami command line tool to query computer and username 28->95 38 whoami.exe 13 28->38         started        signatures11 process12 signatures13 83 Tries to steal Mail credentials (via file / registry access) 38->83 85 Tries to harvest and steal browser information (history, passwords, etc) 38->85 87 Modifies the context of a thread in another process (thread injection) 38->87 89 3 other signatures 38->89 41 chrome.exe 38->41         started        43 firefox.exe 38->43         started        process14 process15 45 WerFault.exe 41->45         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/479ca9e4974c18451cc33514037e524b1e04aea73d7ea1e2cec19ae5d443bb5d
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.38 Win 32 Exe x86
Link:
https://app.malva.re/file/73f2176d6e5e406b2fab7993f914bad4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/479ca9e4974c18451cc33514037e524b1e04aea73d7ea1e2cec19ae5d443bb5d/
Threat name:
Win32.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2026-02-10 07:48:39 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i6oktzexjqmekhgdgukag7ssjmpajlvhhv7kdywoygnolvcdxnoq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
error
Formbook
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/260210-wgd3psez7f/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Drops startup file
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Unpacked files
SH256 hash:
479ca9e4974c18451cc33514037e524b1e04aea73d7ea1e2cec19ae5d443bb5d
MD5 hash:
73f2176d6e5e406b2fab7993f914bad4
SHA1 hash:
8ddd5fd4f8a85609786082755ed0900b7cf707e9
Link:
https://www.unpac.me/results/4e899ad5-593d-4406-b368-f17fee9d0bbf/
SH256 hash:
beea4fa7128077d531d01fd2077af6dece4eee9e6fce00584bb5937a9d06c43f
MD5 hash:
112d37d94a45a8da0402acde90d1a919
SHA1 hash:
08cfda907648fc914468c54411ad3758c1ed8ff5
Link:
https://www.unpac.me/results/4e899ad5-593d-4406-b368-f17fee9d0bbf/
SH256 hash:
724245ae3fd7d1632d6e059ad6b79ef92dec9148c6727f9779e8b23800f06260
MD5 hash:
8fb5863356fd4d1d74697aec919b07f4
SHA1 hash:
967caffb512da12ab9dc106004e2ad6b6809538b
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/4e899ad5-593d-4406-b368-f17fee9d0bbf/
Parent samples :
bde515aa510b4c30129ab004d7edaab51539f3170289be077bc2649168ccafa4
24b68cc56ca49a71fe5b439d0c765afe01552472c3793562519984803e8d1db7
479ca9e4974c18451cc33514037e524b1e04aea73d7ea1e2cec19ae5d443bb5d
5531654e84b8a3de3ce10423d12052f06db68e27805f874a1c4142bc27b0a37e
9e4efb8300d61fa29a18a9169965c531fc547234d3ced0532aa341f899801621
3c23073583bd33a068be551134983e7958884cb7656a4da03d9cc737b262f1ee
c9a7422e9bda1f8e36f23648857c16fe5332be73c474503b6502eccf4d5ed059
e37c838dc5eaa1b302ffbd8721c6a5f52a068e8f78bbec63b19b950462fe6cf8
fc72b3ca2ae3fb65114b8c60e539aec25d8e0383204e7cda9794e8b66d2a098c
9843f5987f4cc3ecb4dc341853be6549567da44e273162a36841020464cd9258
SH256 hash:
23eae27122a66de5bd08b5805a79bfef2963c4bdaf66a9ae74e192f5b80e369e
MD5 hash:
08510d1e5abf64bd46ec42c764c14ac7
SHA1 hash:
ee4c6f602fb512238163b56bd105642ee76499d5
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/4e899ad5-593d-4406-b368-f17fee9d0bbf/
SH256 hash:
f2011baf44475f51cb58de1952464a9321d2599fe97b1422ce70b8807de01a9d
MD5 hash:
08a6a33b2ccb71c74cd13af5f6c93bed
SHA1 hash:
fe941799eb458fc4424c5ad3fc43749615a2aa34
Link:
https://www.unpac.me/results/4e899ad5-593d-4406-b368-f17fee9d0bbf/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/479ca9e4974c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/479ca9e4974c18451cc33514037e524b1e04aea73d7ea1e2cec19ae5d443bb5d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/52933/

Comments