MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 48a97295064a502f5229c9e329ce10fd99ff7bb29ffcc09bf863519921e63be4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 15
| SHA256 hash: | 48a97295064a502f5229c9e329ce10fd99ff7bb29ffcc09bf863519921e63be4 |
|---|---|
| SHA3-384 hash: | 91d72c5a7c0641a7405b3fee46a1f1fdd69232a44c14a04d3165a956836fa8ea9357c99b8def40395ababc5806a9469a |
| SHA1 hash: | 0bdcae833870beada6f36a4f428ae664dc23c966 |
| MD5 hash: | 5fe82dc3037a8891c394a32bd6110292 |
| humanhash: | double-hawaii-nebraska-football |
| File name: | New_Order28092026.pdf.bat.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 804'352 bytes |
| First seen: | 2026-10-14 15:35:20 UTC |
| Last seen: | 2026-10-14 15:36:36 UTC |
| File type: |  exe |
| MIME type: | application/vnd.microsoft.portable-executable |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'287 x AgentTesla, 20'697 x Formbook, 12'401 x SnakeKeylogger) |
| ssdeep | 24576:UwWHoT1vRrBWucsyC/BMvy5sk35tErqc+0:TWYvRVlrC7+0 |
| TLSH | T14B05F25433649A07C9A567F51D31F23813F9AEEEA511E21A8FE9ACEB3A31F004D44793 |
| TrID | 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| Reporter |  TomU |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
5
# of downloads :
97
Origin country :
CHVendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-10-14 16:53:59 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Verdict:
Malicious
Score:
99.1%
Tags:
virus micro cupi
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching a service
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Creating synchronization primitives
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
entropy krypt masquerade packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-09-28T07:56:00Z UTC
Last seen:
2026-10-16T00:25:00Z UTC
Hits:
~100
Malware family:
Formbook
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.34 Win 32 Exe x86
Threat name:
ByteCode-MSIL.Spyware.Noon
Status:
Malicious
First seen:
2026-09-28 10:41:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
26 of 36 (72.22%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
XWorm
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
48a97295064a502f5229c9e329ce10fd99ff7bb29ffcc09bf863519921e63be4
MD5 hash:
5fe82dc3037a8891c394a32bd6110292
SHA1 hash:
0bdcae833870beada6f36a4f428ae664dc23c966
SH256 hash:
9fd7091646f370b4d16f963ab367ddb0073da856fbe06d9e7cfe21359f2c5a96
MD5 hash:
43db5f9358f7c3beed5220b30a3a3e84
SHA1 hash:
0fa37404f65409c691db970901ff0c7201c21de6
SH256 hash:
82ff1eac28553a58b84ff32e9fb2ef23ade0f81a541d5ead87ebc530e552c3f7
MD5 hash:
4e93ca9957b91eb441c3f91b96f4c80b
SHA1 hash:
cb92b052f0888c070defa6e55778389d2bf63f91
SH256 hash:
bc89b029b24fde6683984750f02da267e9def9c83d1e19f7a355b9ddc01b000a
MD5 hash:
d746d27eb694af7fd0ba01a5d1816f6a
SHA1 hash:
de6a212d427410f3ea8b486d7f48ea01a3b53129
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DotNet_BitmapAssemblyLoader_KWBORU_Family |
|---|---|
| Author: | ShadowOpCode |
| Description: | Detects the outer .NET loader template that reconstructs a managed assembly from bitmap RGB data and invokes it reflectively |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait |
|---|---|
| Author: | Marjoriefort |
| Description: | Detects Derialock (pe, etat extrait) |
| Rule name: | WIN_Sample_Unique_69354b41 |
|---|---|
| Author: | Marjoriefort |
| Description: | Specimen unique (soumission Bazaar) - strings distinctifs propres au sample |
| Reference: | 69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.