MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4c7e5c9b9468a7c8749b000d83e22da94a2252d45965163e8a744d9fde4fa6ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 8
| SHA256 hash: | 4c7e5c9b9468a7c8749b000d83e22da94a2252d45965163e8a744d9fde4fa6ab |
|---|---|
| SHA3-384 hash: | 95e5fec03c560781b933f2301c2fe8bff562bf3b79192a754ad571f5eeee0851eb2a3c1b2b4839e6fca3edb69ba95f93 |
| SHA1 hash: | f5c63a0ae74b4a1aa1105e41b1622223c44c8ee9 |
| MD5 hash: | 6d982efc879b5135b18bc1910ed86dce |
| humanhash: | iowa-april-wyoming-pizza |
| File name: | greatattitudewithgoodfeaturesgive.hta |
| Download: | download sample |
| Signature | Formbook |
| File size: | 15'760 bytes |
| First seen: | 2025-05-16 19:19:49 UTC |
| Last seen: | Never |
| File type: |  hta |
| MIME type: | text/html |
| ssdeep | 192:/b67w8P67PW8SMakP5xg6iEB6aMgc6+Dw8NF67p3:z677P67pxa4Tg6iC6aMgW7n67F |
| Threatray | 2'189 similar samples on MalwareBazaar |
| TLSH | T1FD6257AAC7BBBD86CD43FB2FB53DA324415D052ED8B9C8941600B00A94E431AF4E49DF |
| Magika | txt |
| Reporter |  abuse_ch |
| Tags: | FormBook hta |
Intelligence
File Origin
# of uploads :
1
# of downloads :
104
Origin country :
DEVendor Threat Intelligence
Detection(s):
Verdict:
Malicious
Score:
94.9%
Tags:
vmdetect autoit emotet
Result
Verdict:
Clean
File Type:
HTA File
Verdict:
Unknown
Threat level:
2.5/10
Confidence:
100%
Tags:
masquerade
Verdict:
Malicious
Labled as:
VBS.Asthma.2.707B92D4
Result
Threat name:
Cobalt Strike, FormBook
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Signature
Binary is likely a compiled AutoIt script file
Detected Cobalt Strike Beacon
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PowerShell case anomaly found
Powershell drops PE file
Queues an APC in another process (thread injection)
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Suspicious MSHTA Child Process
Suricata IDS alerts for network traffic
Suspicious command line found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Threat name:
Script-WScript.Trojan.Asthma
Status:
Malicious
First seen:
2025-05-16 10:23:48 UTC
File Type:
Text (JavaScript)
AV detection:
7 of 24 (29.17%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
unc_loader_036
autoit
Similar samples:
+ 2'179 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
defense_evasion discovery execution
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Blocklisted process makes network request
Downloads MZ/PE file
Evasion via Device Credential Deployment
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.