MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47dd1fc6d808f2e0912cdd4d8a2e0a116830d03f4cebb2b416d4394cf18ecdb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47dd1fc6d808f2e0912cdd4d8a2e0a116830d03f4cebb2b416d4394cf18ecdb5
SHA3-384 hash: c99e273b1296d76a075b05386e53bb52e8d38f376d753e7d39414b56c9e440b0afd1f592ae69a20b7fdf4a766943adbb
SHA1 hash: d210d59817254e4cd287e25b2f8aeb6858be5689
MD5 hash: 5c00b3763e1b552dc88e14fd41e90968
humanhash: maine-montana-black-pizza
File name:PURCHASE ORDER LPO 2674853.bat
Download: download sample
Signature Formbook
Create hunting rule
File size:365'494 bytes
First seen:2025-09-17 09:11:13 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 3072:2GGGGGG8pFqGGGGGGGGGGGGGsDc1Grpi/cLSjZPGGGGGG8pFqGGGGGGGGGGGG+G7:7QlqLrR
Threatray 195 similar samples on MalwareBazaar
TLSH T19D744C21A62B953A34E619BC3DB98565FB37DBF810943E50B010589F0BBB90F3CB6794
Magika javascript
Reporter cocaman
Tags:bat FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PURCHASE ORDER LPO 2674853.r09
Verdict:
Malicious activity
Analysis date:
2025-09-17 09:13:14 UTC
Tags:
arch-exec susp-powershell
Link:
https://app.any.run/tasks/34e008d1-d48d-4fce-b8a1-87ffa9500af0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/27887/
Detection(s):
SecuriteInfo.com.PUA.JS.Shell-1.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68ca7b452432032546471ba1
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm cscript findstr lolbin masquerade wmic wscript
Link:
https://www.filescan.io/uploads/68ca7b420d1238ff0aada6ab/reports/cd647482-cfa6-4d1b-9985-c63dccffdb11/overview
Verdict:
Suspicious
Labled as:
BAT/Agent.BDM
Link:
https://www.hybrid-analysis.com/sample/47dd1fc6d808f2e0912cdd4d8a2e0a116830d03f4cebb2b416d4394cf18ecdb5
Verdict:
Clean
File Type:
wsf
First seen:
2025-09-17T02:46:00Z UTC
Last seen:
2025-09-17T02:46:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/47dd1fc6d808f2e0912cdd4d8a2e0a116830d03f4cebb2b416d4394cf18ecdb5/results?tab=lookup
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1779094
Signature
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Found Tor onion address
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample has a suspicious name (potential lure to open the executable)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1779094 Sample: PURCHASE ORDER LPO 2674853.bat Startdate: 17/09/2025 Architecture: WINDOWS Score: 100 43 www.zoina.xyz 2->43 45 www.raginput.xyz 2->45 47 19 other IPs or domains 2->47 63 Suricata IDS alerts for network traffic 2->63 65 Malicious sample detected (through community Yara rule) 2->65 67 Antivirus detection for URL or domain 2->67 71 6 other signatures 2->71 12 cmd.exe 1 2->12         started        15 svchost.exe 1 1 2->15         started        signatures3 69 Performs DNS queries to domains with low reputation 45->69 process4 dnsIp5 81 Suspicious powershell command line found 12->81 83 Bypasses PowerShell execution policy 12->83 18 powershell.exe 14 15 12->18         started        22 conhost.exe 12->22         started        61 127.0.0.1 unknown unknown 15->61 signatures6 process7 dnsIp8 49 diamonddiagnostics.xo.je 185.27.134.131, 49721, 80 WILDCARD-ASWildcardUKLimitedGB United Kingdom 18->49 51 archive.org 207.241.224.2, 443, 49715 INTERNET-ARCHIVEUS United States 18->51 53 dn721801.ca.archive.org 204.62.247.83, 443, 49717 COGENT-174US United States 18->53 73 Found Tor onion address 18->73 75 Writes to foreign memory regions 18->75 77 Injects a PE file into a foreign processes 18->77 24 RegSvcs.exe 18->24         started        27 conhost.exe 18->27         started        signatures9 process10 signatures11 79 Maps a DLL or memory area into another process 24->79 29 y1zsth0dPFV.exe 24->29 injected process12 process13 31 replace.exe 13 29->31         started        signatures14 85 Tries to steal Mail credentials (via file / registry access) 31->85 87 Tries to harvest and steal browser information (history, passwords, etc) 31->87 89 Modifies the context of a thread in another process (thread injection) 31->89 91 3 other signatures 31->91 34 uIQ8BNrK.exe 31->34 injected 37 chrome.exe 31->37         started        39 firefox.exe 31->39         started        process15 dnsIp16 55 www.zoina.xyz 203.161.48.133, 49742, 49743, 49744 VNPT-AS-VNVNPTCorpVN Malaysia 34->55 57 fspbx.net 62.72.47.82, 49758, 49759, 49760 PRTL-DE Germany 34->57 59 9 other IPs or domains 34->59 41 WerFault.exe 4 37->41         started        process17
Score:
84%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/47dd1fc6d808f2e0912cdd4d8a2e0a116830d03f4cebb2b416d4394cf18ecdb5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47dd1fc6d808f2e0912cdd4d8a2e0a116830d03f4cebb2b416d4394cf18ecdb5/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/47dd1fc6d808f2e0912cdd4d8a2e0a116830d03f4cebb2b416d4394cf18ecdb5
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-09-17 08:51:01 UTC
File Type:
Text (Batch)
AV detection:
12 of 38 (31.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i7or7rwybdzobejm3vgyulqkcfudbub7jtv3fnaw2q4uz4mozw2q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0e6b25555ea3bc08519eef033a4518f27121f7e7cace0271e456a361534fe69d
Formbook
47dd1fc6d808f2e0912cdd4d8a2e0a116830d03f4cebb2b416d4394cf18ecdb5
Formbook
664272d1c9d15f1747c86d06066467ccdc54ce0062e1d201950a5a95478f1d99
Formbook
693326e19e98db0b09372ddd5d454b3c23db0fbd20dc2e1671d7395fd150010c
Formbook
7343fde1eb7ed90af6b923297177ae109f2ff9b8e86cee4f5961cf619fad81f4
Formbook
8c2bf37543f505883716f27429754461c61c2b259a882942e59b4ecd0f279b80
Formbook
8e3ac942df072256abcf91e4f1e5c76a09093374a9f5b997905dfc5a8b949e2a
Formbook
9a85868fada912b766b75721172bd8d3c741cb29811490fd8e9f53832712fe89
Formbook
c219396bdbe5ecedd6f6edd308734920f6a52b6cdbefafc16916f07dadffc1c8
Formbook
error
Formbook
+ 185 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook execution rat spyware stealer trojan
Link:
https://tria.ge/reports/250917-k7l1fsxxds/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Malware Config
Dropper Extraction:
https://archive.org/download/optimized_msi_20250904/optimized_MSI.png
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/47dd1fc6d808/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/47dd1fc6d808f2e0912cdd4d8a2e0a116830d03f4cebb2b416d4394cf18ecdb5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r09 2158a255474eab9003f31a5dad938a9ebf6bf5e30eb066395d58ccde2d7b1791

Formbook

Batch (bat) bat 47dd1fc6d808f2e0912cdd4d8a2e0a116830d03f4cebb2b416d4394cf18ecdb5

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 2158a255474eab9003f31a5dad938a9ebf6bf5e30eb066395d58ccde2d7b1791
Cape
Cape
https://www.capesandbox.com/analysis/27887/
  
Dropped by
MD5 c075655c4927bfce54695f3bc5f0a45a

Comments