MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47da5cfdca2ebc32d9406385b91fd6bf343bfdfb899e7ecb76dbfe6632735ada. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47da5cfdca2ebc32d9406385b91fd6bf343bfdfb899e7ecb76dbfe6632735ada
SHA3-384 hash: 7a2c38490aa1be1814f7711bf7732a221648fec01d5d2978335ac80afc2d6563dbf004eb7b7aaf43b92e4681a6eb8778
SHA1 hash: 3da0a2a3ec76aaaae2377383ac343c00f3be5fa8
MD5 hash: c24f355b6fb582fb9c76ab61b019d713
humanhash: green-pizza-papa-white
File name:Quotation.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:799'744 bytes
First seen:2025-06-12 12:21:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:sEeE/DN5tdjjweSCLSS4CAQjf6O1WYa6hKsWD1fBzfrRnJ19QZwAF1ENsdARhhNO:sU/DNL9JuxcyOcYa6sD1VrRHOZ50R
Threatray 2'190 similar samples on MalwareBazaar
TLSH T11D0512491696E607D4A64BB06DB2E3B512BC9FDD9811C713CFECBDEB7D3A6047840290
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter threatcat_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
417
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Quotation.exe
Verdict:
No threats detected
Analysis date:
2025-06-12 12:28:28 UTC
Tags:
netreactor
Link:
https://app.any.run/tasks/5738988b-ba0e-48d9-b179-69883cb5dabf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/9133/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=684ac7908bd5d68a12e81896
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/684ac70c171e01f9593e548e/reports/f246ee14-9423-4c0f-8f33-b4ac55d43739/overview
Verdict:
Malicious
Labled as:
PasswordStealer.Genie8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/47da5cfdca2ebc32d9406385b91fd6bf343bfdfb899e7ecb76dbfe6632735ada
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5da61ba4-b0d7-4549-899f-06d0ff48f544
Result
Threat name:
FormBook, PureLog Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1713237
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected FormBook
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1713237 Sample: Quotation.exe Startdate: 12/06/2025 Architecture: WINDOWS Score: 100 34 www.yczh.xyz 2->34 36 www.rtp-dumdum4dbless.xyz 2->36 38 21 other IPs or domains 2->38 46 Suricata IDS alerts for network traffic 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected PureLog Stealer 2->50 54 6 other signatures 2->54 11 Quotation.exe 3 2->11         started        signatures3 52 Performs DNS queries to domains with low reputation 36->52 process4 file5 32 C:\Users\user\AppData\...\Quotation.exe.log, ASCII 11->32 dropped 64 Injects a PE file into a foreign processes 11->64 15 Quotation.exe 11->15         started        signatures6 process7 signatures8 66 Maps a DLL or memory area into another process 15->66 18 bSohqJsK5PcaLp.exe 15->18 injected process9 process10 20 label.exe 13 18->20         started        signatures11 56 Tries to steal Mail credentials (via file / registry access) 20->56 58 Tries to harvest and steal browser information (history, passwords, etc) 20->58 60 Modifies the context of a thread in another process (thread injection) 20->60 62 3 other signatures 20->62 23 EyIYCtJo2ZNP.exe 20->23 injected 26 chrome.exe 20->26         started        28 firefox.exe 20->28         started        process12 dnsIp13 40 www.thoris.tokyo 46.37.111.94, 49700, 49701, 49702 Y-INTERNETGB Spain 23->40 42 www.yczh.xyz 103.106.190.204, 49732, 49733, 49734 TELECOM-HKHongKongTelecomGlobalDataCentreHK China 23->42 44 11 other IPs or domains 23->44 30 WerFault.exe 4 26->30         started        process14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/47da5cfdca2ebc32d9406385b91fd6bf343bfdfb899e7ecb76dbfe6632735ada
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47da5cfdca2ebc32d9406385b91fd6bf343bfdfb899e7ecb76dbfe6632735ada/
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-06-12 09:18:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
29 of 38 (76.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i7nfz7okf26dfwkamoc3sh6wx42dx7p3rgph5s3w3p7gmmttllna._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
4a8436b32c7ab7bf4942224b5728168e4686f082529831799f358ab54d87f328
Formbook
7a560acc97e0be33258afce759c4c215a91103e7b7447e487d540eca65959f4e
Formbook
a73949bad5ca02ea335dbdd137b4167df29cf443444fbc7e1a491cc728bcc143
Formbook
dd2c856d18e6b598654b821f3d3185ed8563a26e9e65a45676d4d7f869798d80
Formbook
error
Formbook
+ 2'180 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/250612-pkwctsw1dz/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9c3a12c7-647d-4bd8-aa64-32e202c5f552
Unpacked files
SH256 hash:
47da5cfdca2ebc32d9406385b91fd6bf343bfdfb899e7ecb76dbfe6632735ada
MD5 hash:
c24f355b6fb582fb9c76ab61b019d713
SHA1 hash:
3da0a2a3ec76aaaae2377383ac343c00f3be5fa8
Link:
https://www.unpac.me/results/b1a3d970-f53f-421f-8b4e-b92e1c2ab52e/
SH256 hash:
66812c00bd482706605f2c5c76838812aa4e470e28a60fb5247673e43b7c7f8a
MD5 hash:
2879cb6c2c1afd14393b1a3af22c1212
SHA1 hash:
115928d9df0046011b1759faeb1e94c33e1574db
Link:
https://www.unpac.me/results/b1a3d970-f53f-421f-8b4e-b92e1c2ab52e/
SH256 hash:
968ff8644dbb15aba637df26296f07e0347b5df5836c52135e62abe94586e2a6
MD5 hash:
d4ef0826b3327c85d180631020814010
SHA1 hash:
75e887a9a088144ba7c75a10c7bcc6c1df049fea
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/b1a3d970-f53f-421f-8b4e-b92e1c2ab52e/
SH256 hash:
96e9950cf67974cb77800bfde13101e99a4e42f3cb9d72c3bc23231d84556f43
MD5 hash:
c779c93bc76b82192b8b4e404bc057f3
SHA1 hash:
a66b3d25c0e0fa462bb97091591002a43c89b887
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/b1a3d970-f53f-421f-8b4e-b92e1c2ab52e/
Parent samples :
b5bdb3730680b32893f9c4d355682be1582689788762469bdb4efdda8376a57b
5e000909af896e406ecd05a8d6a880322356ac3deb01da1f964a0bb0b225398f
47da5cfdca2ebc32d9406385b91fd6bf343bfdfb899e7ecb76dbfe6632735ada
00181f3297555dab913f5777fc7823c4882929ee81cb52430d19714b8fa85734
ce161a633b539864473065ef127ba76ce9c2202aaee184dbbee5968563462a74
156ffbc1adf860198501bf76e6428debdfa847e13e73796ee9bad6e982bf94d4
b7ca5eee2c0af78525e33094a2c1d38f639824b8f051a50216dc47417f426bba
07b152394aab317e08fc56aa9fd33236cc8ea7a71d58ab9d7660ac70ccb495ec
ecca275df0af28dbbd0b0d74c0eaf5b29194cb5293f1ccdd2ba87f203481852a
5f811f675d487ef9d0cd10ba5f095edadcb38eeeedaa5ec897b3994b954d3212
b72fd1024afa07ad46cd25049ae1ef5e7311b1b2bae35f769263332cf2e7d17d
61c3caec2a3c95494495549b3b538ddbbc3240eb794a57ac759ce4164b880734
SH256 hash:
f7580eb54650cbb962ddb5b34de94588af670d936a477782970b66ae7abb87ca
MD5 hash:
d4978f8a8982536a177962e5a1966c96
SHA1 hash:
516029ebf1b7fa48a23a4c2367b6eddc614829fb
Link:
https://www.unpac.me/results/b1a3d970-f53f-421f-8b4e-b92e1c2ab52e/
Malware family:
zgRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/47da5cfdca2e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/47da5cfdca2ebc32d9406385b91fd6bf343bfdfb899e7ecb76dbfe6632735ada

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 47da5cfdca2ebc32d9406385b91fd6bf343bfdfb899e7ecb76dbfe6632735ada

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/9133/

Comments