MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5398c030ca3834cae98e4cd82ac73dc0cca4e0a98e0f8d11d4e775ac7579293d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 16
| SHA256 hash: | 5398c030ca3834cae98e4cd82ac73dc0cca4e0a98e0f8d11d4e775ac7579293d |
|---|---|
| SHA3-384 hash: | a80e4740085e5e4c0a6a947acf872a604b2bb075b3048da4236aeb29cf8dabf676924a3707f9c5c859dccf230daf27db |
| SHA1 hash: | e218d811916724a81aaea20f629abfda04562d76 |
| MD5 hash: | 6825e3455391e7d3e01c8a035b257e0a |
| humanhash: | earth-twenty-eighteen-west |
| File name: | PO-000172483_pdf.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 882'688 bytes |
| First seen: | 2026-05-20 17:40:41 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'197 x AgentTesla, 20'351 x Formbook, 12'365 x SnakeKeylogger) |
| ssdeep | 24576:6EkDOmZ4OuYmP0lAI4fJ2MDFWAMKUkzVS93IqsPpCl:7yOnhD8AMKUkzVSxsc |
| Threatray | 19 similar samples on MalwareBazaar |
| TLSH | T1141501443351D906C5A64BB029B0E3F913749ECDA612E3079FEEBDFB7C2A7916D09242 |
| TrID | 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| File icon (PE): |  |
| dhash icon | 032c5c316bd5c51b (3 x Formbook, 1 x AsyncRAT) |
| Reporter |  TomU |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
71
Origin country :
CHVendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Malware family:
n/a
ID:
1
File name:
PO-000172483 pdf.exe
Verdict:
No threats detected
Analysis date:
2025-01-08 05:51:45 UTC
Tags:
netreactor
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Verdict:
Malicious
Score:
70%
Tags:
stration shell micro
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
base64 bitmap masquerade obfuscated packed packed phishing reconnaissance roboski stego vbnet
Verdict:
Malicious
Labled as:
lazy.Generic
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-01-07T23:20:00Z UTC
Last seen:
2026-04-09T06:56:00Z UTC
Hits:
~1000
Detections:
HEUR:Trojan-PSW.MSIL.Agensla.gen Trojan.MSIL.Crypt.sb Trojan-Spy.Noon.HTTP.ServerRequest PDM:Trojan.Win32.Generic Backdoor.Agent.HTTP.C&C VHO:Trojan-PSW.Win32.Convagent.gen Trojan-Spy.Win32.Noon.sb HEUR:Trojan.MSIL.Injector.gen Trojan.Win32.Agent.sb Trojan.MSIL.Taskun.sb Trojan.MSIL.Inject.sb
Malware family:
Formbook
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Gathering data
Verdict:
Malicious
Threat:
Family.FORMBOOK
Threat name:
Win32.Trojan.AgentTesla
Status:
Malicious
First seen:
2025-01-08 04:05:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
27 of 36 (75.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
unc_loader_037
wannacryptor
Similar samples:
+ 9 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
5398c030ca3834cae98e4cd82ac73dc0cca4e0a98e0f8d11d4e775ac7579293d
MD5 hash:
6825e3455391e7d3e01c8a035b257e0a
SHA1 hash:
e218d811916724a81aaea20f629abfda04562d76
SH256 hash:
b3cd7d63ee90205481b5da945f683542a35dd1f4aeb48db32207bfbbb33ca6b6
MD5 hash:
cb7ea23382c3a96acd7150ee76c5777b
SHA1 hash:
1501f53f7f8ccc842d1e015109bbee99db8592c1
SH256 hash:
4cb731e70707ad80440e64c52d99fe2c0e1f1ac9ad6da0990d5bc3c297621901
MD5 hash:
29d8bcb9f05227305fd4d669977da5c9
SHA1 hash:
1b79560b8fb03726f2c68fac104a7c5d6cf7384e
SH256 hash:
4de1f0a21ef98284bff986c91c56da0d1e130c1e983ea5f6854f0e724a405c76
MD5 hash:
be0804cf30f52efc8f461ec3053dad1d
SHA1 hash:
2ac0dd1095c117ae4ee6c1f9cf025300a2232a89
SH256 hash:
fd4202b27b887e3a3b4d9bc0ff22b2689c6fa7de296f7ee4082edebe76b21cbd
MD5 hash:
cae69c1700c7887e177148bdcc278c4c
SHA1 hash:
ed566164f8a7cd5bfaf184321f64d10f6dd849b9
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.