MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ffb20e1a907ba09b16385b701c037d5f8d62f3153be1ef80260e8fb7c6143a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 21


Intelligence 21 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ffb20e1a907ba09b16385b701c037d5f8d62f3153be1ef80260e8fb7c6143a3
SHA3-384 hash: 7ad67587b5ec2ca4a2f6997edf5bb3c7e2f3dad35e6269dd2cc92d527acfffe2c1076e4d4b43ed24fc421d320c7a5d51
SHA1 hash: daab0dd2fded64cd42722a05f6a4f96beefcc4ea
MD5 hash: 6859e87936c639b599311f2076f70838
humanhash: item-seventeen-eight-mirror
File name:PI-HY241018MI14 K629.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:691'712 bytes
First seen:2025-12-08 11:07:57 UTC
Last seen:2025-12-08 15:59:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:FLURl5nphFxprLJA0US99NZg4Pb3P79YMetR4w0DXHwPK/MSp:675przrLumlZfPb3PxYMetR83w
Threatray 132 similar samples on MalwareBazaar
TLSH T175E412952BADCF16D4BE0BF211A1E33187B56E9FB061D24A4FCEADEB7424B114A00753
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter cocaman
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
5
# of downloads :
90
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/deb3562f-faec-4f95-865b-78ad5ed33a7b/
Malware family:
formbook
Create hunting rule
ID:
1
File name:
PI-HY241018MI14K629.exe
Verdict:
Malicious activity
Analysis date:
2025-11-27 12:07:54 UTC
Tags:
auto-sch-xml formbook stealer xloader
Link:
https://app.any.run/tasks/7040b6ad-3286-42e8-b345-b33cb3310cf7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/42988/
Detection(s):
SecuriteInfo.com.Trojan.Inject6.17597.12970.12647.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69283f196cb1dcd5778188e4
Tags:
stration shell spawn
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
krypt packed snakekeylogger vbnet
Link:
https://www.filescan.io/uploads/6936b1a6bba50eaf0426b890/reports/7b72cdfe-5276-423b-ac48-5479d5567b37/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4ffb20e1a907ba09b16385b701c037d5f8d62f3153be1ef80260e8fb7c6143a3
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-27T04:22:00Z UTC
Last seen:
2025-12-09T14:46:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/4ffb20e1a907ba09b16385b701c037d5f8d62f3153be1ef80260e8fb7c6143a3/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e07c7d69-2c04-4a54-a820-e2642d73b7dc
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1828717
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Scheduled temp file as task from temp location
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1828717 Sample: PI-HY241018MI14 K629.exe Startdate: 08/12/2025 Architecture: WINDOWS Score: 100 62 wyw.pt.cdn-dysxb.com 2->62 64 www.tovira.live 2->64 66 23 other IPs or domains 2->66 78 Suricata IDS alerts for network traffic 2->78 80 Antivirus detection for URL or domain 2->80 82 Sigma detected: Scheduled temp file as task from temp location 2->82 84 9 other signatures 2->84 11 PI-HY241018MI14 K629.exe 7 2->11         started        15 jXaPvzNyKWEv.exe 5 2->15         started        signatures3 process4 file5 54 C:\Users\user\AppData\...\jXaPvzNyKWEv.exe, PE32 11->54 dropped 56 C:\Users\...\jXaPvzNyKWEv.exe:Zone.Identifier, ASCII 11->56 dropped 58 C:\Users\user\AppData\Local\...\tmp4F09.tmp, XML 11->58 dropped 60 C:\Users\...\PI-HY241018MI14 K629.exe.log, ASCII 11->60 dropped 94 Adds a directory exclusion to Windows Defender 11->94 17 PI-HY241018MI14 K629.exe 11->17         started        20 powershell.exe 23 11->20         started        22 powershell.exe 23 11->22         started        28 2 other processes 11->28 96 Multi AV Scanner detection for dropped file 15->96 98 Tries to delay execution (extensive OutputDebugStringW loop) 15->98 100 Unusual module load detection (module proxying) 15->100 24 schtasks.exe 15->24         started        26 jXaPvzNyKWEv.exe 15->26         started        signatures6 process7 signatures8 74 Maps a DLL or memory area into another process 17->74 30 MqcxVnJIuhe.exe 17->30 injected 76 Loading BitLocker PowerShell Module 20->76 32 conhost.exe 20->32         started        34 WmiPrvSE.exe 20->34         started        36 conhost.exe 22->36         started        38 conhost.exe 24->38         started        40 conhost.exe 28->40         started        process9 process10 42 fsutil.exe 30->42         started        signatures11 86 Tries to steal Mail credentials (via file / registry access) 42->86 88 Tries to harvest and steal browser information (history, passwords, etc) 42->88 90 Modifies the context of a thread in another process (thread injection) 42->90 92 4 other signatures 42->92 45 nqOqHQ9gQ5GzS.exe 42->45 injected 48 chrome.exe 42->48         started        50 firefox.exe 42->50         started        process12 dnsIp13 68 tisvbz.114dodcqczey.com 156.247.39.134, 49728, 49729, 49730 PEGTECHINCUS Seychelles 45->68 70 i-v-c.ca 149.56.225.6, 49700, 49701, 49702 OVHFR Canada 45->70 72 12 other IPs or domains 45->72 52 WerFault.exe 48->52         started        process14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4ffb20e1a907ba09b16385b701c037d5f8d62f3153be1ef80260e8fb7c6143a3
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.43 Win 32 Exe x86
Link:
https://app.malva.re/file/6859e87936c639b599311f2076f70838
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ffb20e1a907ba09b16385b701c037d5f8d62f3153be1ef80260e8fb7c6143a3/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/4ffb20e1a907ba09b16385b701c037d5f8d62f3153be1ef80260e8fb7c6143a3
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-11-27 07:28:29 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j75sbynja65atmldqw3qdqbx2x4nmlzrko7b56acmdupw7dbiorq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0be718f7b7a74c02cb6e13cf89c32e36e3385d3c8d6bf11459e8a43afafe4ab4
Formbook
bf68190a743215ba83339703d99ecb3507f00182ca1fc4dce9a472e4b0c5f757
Formbook
e7a7b1d0ebf9cbb2760f3795b42b1b39596ab0eabf1cb12417ba2e8e42494708
Formbook
ecd80dc690eee6d7f89ad7f036aed2000c548440fabd8df91ab539307eb317aa
Formbook
error
Formbook
+ 122 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery execution persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/251208-m8qq5swqgp/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7b09618d-3939-4f7e-9edb-b5d5c40a7bfb
Unpacked files
SH256 hash:
4ffb20e1a907ba09b16385b701c037d5f8d62f3153be1ef80260e8fb7c6143a3
MD5 hash:
6859e87936c639b599311f2076f70838
SHA1 hash:
daab0dd2fded64cd42722a05f6a4f96beefcc4ea
Link:
https://www.unpac.me/results/3f872aa5-5e45-4ab3-b038-67f496127537/
SH256 hash:
3aa8ce5d4766e6fa27c0f3e031c1425b79322fc25ced61c68998ddd0fe84afe0
MD5 hash:
62963935f4f4a7a5d71e15077781146b
SHA1 hash:
374f566ec38e44ea82e0aef8c79417067b37f003
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/3f872aa5-5e45-4ab3-b038-67f496127537/
Parent samples :
5fc5368bad8a8b519f2c392b97c458d9425307b00d52aaadea20eba58e8eeb24
707fdafc56b969ced0f79032c766da29582068ae2630074ec8d41c4d53a73773
ac7a2d43da192df88b772d5f18ad2fbfff501236b4593c0e608474fedde91508
a0f0d732fb63ac2e8801fb5f3a7f969952a7fbdb8b2a782c64cb1c1c14bda72c
4528e9b7d05236ab6a225911e8978af4a7d49bc0221b5529d40ee85b60b0dae7
0be718f7b7a74c02cb6e13cf89c32e36e3385d3c8d6bf11459e8a43afafe4ab4
35c4d93f942a492df6f2c7a905cc0c05d8d0013f8361ef0453762ce8ed74a6c8
93d8f58337eb1309d7fadafe6707dde3a7d20d65870d05a689b3c2f264e61193
74ace00f731591af315dda87a91dcad538db3fab7a62d9e8612eef59dc128bde
e7a7b1d0ebf9cbb2760f3795b42b1b39596ab0eabf1cb12417ba2e8e42494708
165b528fb02e35b12a59a311102a8bef74ec2f0bf908864fd7fa7ed8f917261e
bf68190a743215ba83339703d99ecb3507f00182ca1fc4dce9a472e4b0c5f757
5659b4ea8582b110707f84728ceeb09d22e72c0f729a02d6d73dbf268b2397bd
b4e1932f23a54390bc8743dfa8a7eea4c3e446eae0c97625d780988688274bf3
1f9e7ccdbb6aecb1c353461b5bc162a24c3df9acb5493d76aa0e8f1c6ec1190d
6419d74ea82b7c45bac56aba550a556791e76110e1af3c07794773daa8900032
4ffb20e1a907ba09b16385b701c037d5f8d62f3153be1ef80260e8fb7c6143a3
15890e027eddc1d4216eb97e3700de9069187fed0526047a148cd67705b1f8d6
651859b30c796cf59166ca018a2b4f18c996af4e688d302466ae56a5712b72a7
36271b3690553ed6d67f3b4f789686c6addfe0704e3852c7173aeeb62ae99402
75bb652c901a98ba61bc0baae6b7e6b1e9605ae11b8e9af441d0636751ac89a1
d54f9aa94e3319c4f55a5204e210bfd81e258ef0aa789b372e4516d3683a3e8c
1603ebc35858fe5eb23519fceb18edc6566022ec9d6393a0eb61597fb70e3df2
4b3c7e98f64622c68cd4d61b313b7a07523e1276eb0e66fd1187e8ef2ddec23d
85bfd7c03d84af32087ec4bf003fd32f970339800345620a8cce138f3847b9ed
f72965f2590970749410784883b637e42f6b05466767232fa4d0b754d4a0054d
e401c37dcfe4433d2b0fdbe449f905554b5449d397eb18e2c78cca0b10dc113b
a0f0473fdc61c805b124ed9b8a2e7dc17a16116118da16b7650f04936c38f184
c87794c2fbf18de86169adc7b50d5b828d8e7ec24c483bc24d429068e585762a
3a314ab3e162a1d14105a5a2f6116c461c8a69d9cf614f79521aed9effa61385
3a279099e6b83675a0f1b4ad779734a1c718d6b19a9ab225c54be70c78108ab5
b1cc11582118c8e46f487673a2d0bfc8ecd8c3703aae25195dff8120106b4277
d4f7093db94b0587b0d66fc2795be733423564739109468222cb2560546e230f
6fb8d03893d2eb011b8ec0de9b4d276528047a6c8b833cc8e7f1398ecc1695b8
70b4895b9344e87470809850e75fb9355d3d46ec799221c1232c4d6128b814f7
5b3cc96740f0b6d508064e77b919b7f26e0d4d63d1541fbae0ced67efa83a668
4de3da2145094b2d623f289bb59e0315edaa2a4820603e1b0384d96da159484c
f239532b415d0769dea6827221c226555e1c4bda21ecd050041d829021c52d52
32f152c9fe6debe129b961dcc4e158e2d0329de2793a15f26e8d4ed5bbe2ce62
d463661f048c60c88a16d49f9578d5eb57262c2c60ee06ab5b3e2d5832183542
2a985f28930a096549702d1405257ae47f8503973abaa406fde72ec086d2a546
d6f0f38727c762b36df15c44ef60ca77e766fb4f961634b21f4a2c806c481038
9d1638b1dd03a382ff17a517be8a43281799bdc7af7b485a5e3c494712663634
5a0b5dc86cd2a408434f885be7c44ae25ac4e3b7320da9737119f81183be9dba
a7db6df5960231b52632b929d91f56f275347d1af9b18326d1ebbf575eb5f2ba
dfba3d114561074b5379a1827a895a01bed990ceefc70b74e8031c791b1ec4f4
82a4425f807c071dedf43a2c116cf0d7ad4f0945adb47dc10378365cff8f9c8b
36d699808361bcf77a1147c09dc4df6319b7bbf670814ab1f882bc2668fc11c0
1a895996e3edf28787c2076049c1ec3ce137824bfbdff3dc6e5e020077762c85
SH256 hash:
bca978330944842a1e41f96c687c7abb17c7e2c2dead97b32b0fe93350ab6ae4
MD5 hash:
f8a94a2ec81a38282cb918e98d5e6e8c
SHA1 hash:
a98a76b025575087d6a71b4c0f3ed4f12ec97be0
Link:
https://www.unpac.me/results/3f872aa5-5e45-4ab3-b038-67f496127537/
SH256 hash:
54cb5327cf6e857b50590bdb9af41ca1533180b1a9a0ab1f82b409cee629aee5
MD5 hash:
14fc44f265c96fd77588c3180686e7e4
SHA1 hash:
dda3c99db1ac33dadb0884b082108bda33bcf522
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/3f872aa5-5e45-4ab3-b038-67f496127537/
SH256 hash:
cb0b901cbe811428ef5ff399c6e7d08227ec8e670f3ed388995063eea767f9cc
MD5 hash:
6f967e05abad0c4b16b10a5150161c65
SHA1 hash:
d0733becb4f156404c2668c373eab36f5fa5953a
Link:
https://www.unpac.me/results/3f872aa5-5e45-4ab3-b038-67f496127537/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4ffb20e1a907/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4ffb20e1a907ba09b16385b701c037d5f8d62f3153be1ef80260e8fb7c6143a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 6bf4012ff762873ef1d901dfe9ea9a43904fab5e26af1d8cf042b18f560bea8e

Formbook

Executable exe 4ffb20e1a907ba09b16385b701c037d5f8d62f3153be1ef80260e8fb7c6143a3

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 6bf4012ff762873ef1d901dfe9ea9a43904fab5e26af1d8cf042b18f560bea8e
Cape
Cape
https://www.capesandbox.com/analysis/42988/
  
Dropped by
SHA256 0b54518d614d1263fb51e6a228025fff5cc297269a632ba52a287538d521eab6
  
Dropped by
MD5 9a72584fe74b42563a3b0452511f8e85
  
Dropped by
MD5 be6c4bf14bf4d07013cb61df71187ae8

Comments