MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d785c8d5b76df07f04f87f542e375b2ac96ff64f28b6282179a005d801d9c1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 18


Intelligence 18 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d785c8d5b76df07f04f87f542e375b2ac96ff64f28b6282179a005d801d9c1d
SHA3-384 hash: 978b5cb55e7f369216b4ae3cc5b89aa9c613a5c56f2ee838614b8d67666046b2073ef642fd9c5a8b1ec3501f8d36afd6
SHA1 hash: b20c81f00fa0f6f80b345e28317d79672b89d989
MD5 hash: 454c0f50b56df85436d75f071927bd36
humanhash: bakerloo-papa-east-social
File name:ungziped_file
Download: download sample
Signature Formbook
Create hunting rule
File size:680'960 bytes
First seen:2026-01-02 20:34:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'795 x AgentTesla, 19'693 x Formbook, 12'274 x SnakeKeylogger)
ssdeep 12288:T64LAlkI42tAHOPe8hfxQyH+NlJy05KoZKZ4M7Fv7uUipa5ud2lrWsN/aPhO:CWw555HQJh5zMFz3iNcKQaPY
TLSH T1ACE401D13E396712DDB046319629DDBD82640E683015BED36AED7BDB3BD8310AA0CF12
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/a0715656-6229-47cc-9b4c-a7a8af45350a/
Malware family:
n/a
ID:
1
File name:
_4d785c8d5b76df07f04f87f542e375b2ac96ff64f28b6282179a005d801d9c1d.exe
Verdict:
No threats detected
Analysis date:
2026-01-02 21:01:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f9712410-8be8-465c-a07c-cfc972b58621

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/47305/
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6958321ae148d42004deb62f
Tags:
virus msil
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed vbnet
Link:
https://www.filescan.io/uploads/69582fae8d1aa9829e294816/reports/20b07a10-1dd5-4060-9214-81f690739a37/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4d785c8d5b76df07f04f87f542e375b2ac96ff64f28b6282179a005d801d9c1d
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-17T05:11:00Z UTC
Last seen:
2026-01-04T04:32:00Z UTC
Hits:
~100
Detections:
PDM:Trojan.Win32.Generic Trojan.MSIL.Inject.sb Trojan-Spy.Noon.HTTP.ServerRequest Trojan-PSW.Win32.Stealer.sb Backdoor.Agent.HTTP.C&C Trojan-Spy.Win32.Noon.sb Trojan.MSIL.Taskun.sb Trojan.MSIL.Crypt.sb HEUR:Trojan-Spy.MSIL.Noon.gen
Link:
https://opentip.kaspersky.com/4d785c8d5b76df07f04f87f542e375b2ac96ff64f28b6282179a005d801d9c1d/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bd5ed98c-22de-497e-bbb7-3a6eb130a76f
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4d785c8d5b76df07f04f87f542e375b2ac96ff64f28b6282179a005d801d9c1d
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.31 Win 32 Exe x86
Link:
https://app.malva.re/file/454c0f50b56df85436d75f071927bd36
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4d785c8d5b76df07f04f87f542e375b2ac96ff64f28b6282179a005d801d9c1d/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/4d785c8d5b76df07f04f87f542e375b2ac96ff64f28b6282179a005d801d9c1d
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2025-12-17 08:19:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jv4fzdk3o3pqp4cpq72ufy3vwkwjn73e6kfwfaqxtiaf3aa5tqoq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
error
Formbook
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/260106-l3m8dsfk91/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9b5e98c8-6a3c-4ec1-b265-783538f9584a
Unpacked files
SH256 hash:
4d785c8d5b76df07f04f87f542e375b2ac96ff64f28b6282179a005d801d9c1d
MD5 hash:
454c0f50b56df85436d75f071927bd36
SHA1 hash:
b20c81f00fa0f6f80b345e28317d79672b89d989
Link:
https://www.unpac.me/results/85dc1874-f884-45b2-bbbd-36fdfdd9e40e/
SH256 hash:
6340568a9704183a3a9c84cdf3ca54373c6a97f143dcb4dc1d75c762b9ca70e9
MD5 hash:
6c32fdb289cd02dce797983d113e5637
SHA1 hash:
1fcf4aeed810a204f948864b71daf8168bc24bff
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/85dc1874-f884-45b2-bbbd-36fdfdd9e40e/
SH256 hash:
6bdccfdbecdc314f45d42233140962b087813c86073968ac9066d148eb8f290a
MD5 hash:
2305fdf35ac039df7aff1420d17c0783
SHA1 hash:
3d763a810fba8b00f553b1efd1cf7f7888d88a52
Link:
https://www.unpac.me/results/85dc1874-f884-45b2-bbbd-36fdfdd9e40e/
SH256 hash:
1f34fb5ac599798b7dbb04cd07c878041fb304d8d07293690076e895ec8ff8e6
MD5 hash:
789827c7834e0e4801afa5bd08c6bb94
SHA1 hash:
929f28c8b10383dfafa83e1d03cd29b21e227ea7
Link:
https://www.unpac.me/results/85dc1874-f884-45b2-bbbd-36fdfdd9e40e/
SH256 hash:
5c9080de2d4515e0e6d1f5fa7d379576c0b9de3e3d4b6832b95b24cd51dad74e
MD5 hash:
5d95032f62cc91a74212210f0a37882a
SHA1 hash:
3628ce54a60c7f189a7c45a5ce60852109147ce8
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/85dc1874-f884-45b2-bbbd-36fdfdd9e40e/
Parent samples :
4d785c8d5b76df07f04f87f542e375b2ac96ff64f28b6282179a005d801d9c1d
0fb639ad1798449d4dd32d0d4fe0b2076bcd3f22c0ca71123029ddbebc79fbff
c6792922c5d98b83a6f89ae037a9ab9c83085f173e7542e09f9fff143ddd42b5
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4d785c8d5b76/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/4d785c8d5b76df07f04f87f542e375b2ac96ff64f28b6282179a005d801d9c1d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:Formbook
Create hunting rule
Author:kevoreilly
Description:Formbook Payload
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:TH_Win_ETW_Bypass_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Windows ETW Bypass Detection Rule - 2025
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 4d785c8d5b76df07f04f87f542e375b2ac96ff64f28b6282179a005d801d9c1d

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/47305/

Comments