MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60f6042bd8477be0193a8936e98dfd3734ab7a6255a9af5f994265502e71f40b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60f6042bd8477be0193a8936e98dfd3734ab7a6255a9af5f994265502e71f40b
SHA3-384 hash: ded41ba0b3a9dd27c4e5c297bffe9eec548eb2373c9c88038fda90fbe929dec05f3102c2e43c5c241cda55fefc51e7f4
SHA1 hash: de0337f994d58bbf515b974b8249d3d8b5ed57e6
MD5 hash: 5e8a76d40733d866a630e0f3400405e4
humanhash: rugby-delta-minnesota-foxtrot
File name:Swift_Copy_MT103_839_Pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'365'504 bytes
First seen:2025-06-23 09:12:48 UTC
Last seen:2025-06-30 07:03:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b768923437678ce375719e30b21693e (143 x Formbook, 25 x MassLogger, 22 x SnakeKeylogger)
ssdeep 24576:d5EmXFtKaL4/oFe5T9yyXYfP1ijXda69Kkeu+tOGPZyRW5InVn:dPVt/LZeJbInQRa0Zeul+ZyRW5
Threatray 4'875 similar samples on MalwareBazaar
TLSH T18755CF037791C162FFAB95330B56F2125BBC6A260523B61F12981DB9BD705B01A3F7A3
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon cac292f2eacaf2f2 (2 x Formbook)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
589
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Swift_Copy_MT103_839_Pdf.exe
Verdict:
No threats detected
Analysis date:
2025-06-23 09:18:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f332540f-c024-4dde-ae8f-612bd5ae8055

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10663/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68591b0132ed47a3a8d698e0
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/60f6042bd8477be0193a8936e98dfd3734ab7a6255a9af5f994265502e71f40b
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/19230329-3f5f-441c-9053-3c67039ffeff
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1720772
Signature
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Initial sample is a PE file and has a suspicious name
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1720772 Sample: Swift_Copy_MT103_839_Pdf.exe Startdate: 23/06/2025 Architecture: WINDOWS Score: 100 35 www.tfx2369.xyz 2->35 37 www.huqqaankara.xyz 2->37 39 22 other IPs or domains 2->39 47 Suricata IDS alerts for network traffic 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 Yara detected FormBook 2->51 55 3 other signatures 2->55 11 Swift_Copy_MT103_839_Pdf.exe 2 2->11         started        signatures3 53 Performs DNS queries to domains with low reputation 37->53 process4 signatures5 65 Binary is likely a compiled AutoIt script file 11->65 67 Found API chain indicative of sandbox detection 11->67 69 Writes to foreign memory regions 11->69 71 2 other signatures 11->71 14 svchost.exe 11->14         started        17 svchost.exe 3 8 11->17         started        process6 signatures7 73 Maps a DLL or memory area into another process 14->73 19 33pKWJ6P6InKD.exe 14->19 injected 21 WerFault.exe 2 17->21         started        process8 process9 23 label.exe 13 19->23         started        signatures10 57 Tries to steal Mail credentials (via file / registry access) 23->57 59 Tries to harvest and steal browser information (history, passwords, etc) 23->59 61 Modifies the context of a thread in another process (thread injection) 23->61 63 3 other signatures 23->63 26 izYWbEOnkJi.exe 23->26 injected 29 chrome.exe 23->29         started        31 firefox.exe 23->31         started        process11 dnsIp12 41 www.multigames.bet 145.223.95.120, 49693, 80 VBA-ASNL Netherlands 26->41 43 n0fyzn.a.1112dns.com 154.82.100.201, 49715, 49716, 49717 ROOTNETWORKSUS Seychelles 26->43 45 11 other IPs or domains 26->45 33 WerFault.exe 4 29->33         started        process13
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/60f6042bd8477be0193a8936e98dfd3734ab7a6255a9af5f994265502e71f40b
Verdict:
Malware
YARA:
7 match(es)
Tags:
AutoIt Decompiled Executable PE (Portable Executable) Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/5e8a76d40733d866a630e0f3400405e4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60f6042bd8477be0193a8936e98dfd3734ab7a6255a9af5f994265502e71f40b/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-06-23 04:42:15 UTC
File Type:
PE (Exe)
Extracted files:
15
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=md3aik6yi556agj2re3otdp5g42kw6tckwu26x4zijsvaltr6qfq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
003322cf9021b6afa90bd2af7a0e2d5c9d3dccc166b2c703004e37618953563a
Formbook
219b2f19475b0ba36726568f9dd52320c1c44f24c9e3ac018c0742967e157ba2
Formbook
3d9c9606d3bba567a0ce9f2d8c891239cd06c4cb470df92dfcee5fca5a0e7b7b
Formbook
5cf9f8b94a395f9cba3658502e40b014d67026a16da2aa91a3f7bb64931ae8e2
Formbook
88795ccbb26f764aa31d3e28c8df85f970334a67bc61b06682745b185900ea75
Formbook
90f0b142274a5613c660dd9cf60dba79bf5abec4e20734122ca0b2f5b9e7a904
Formbook
error
Formbook
+ 4'865 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/250623-k8s56adp4z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/bd468f23-e6bb-4ffb-b17b-e69cf86d3838
Unpacked files
SH256 hash:
60f6042bd8477be0193a8936e98dfd3734ab7a6255a9af5f994265502e71f40b
MD5 hash:
5e8a76d40733d866a630e0f3400405e4
SHA1 hash:
de0337f994d58bbf515b974b8249d3d8b5ed57e6
Link:
https://www.unpac.me/results/57f6d881-5e0a-4fb4-a94f-2b0dfb274c3c/
SH256 hash:
808c4577fad529df9aa9ee4883c49051e6f21814e3d1139e7e36e80dfd6a3fe8
MD5 hash:
390fe9cc860fe6705fb17135a622472c
SHA1 hash:
7e895d64898a199bea94da72c04e85331ff3178e
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/57f6d881-5e0a-4fb4-a94f-2b0dfb274c3c/
SH256 hash:
33ab0811a6263863dfe60c39546509a65e1437f216436e2c7e58b225ed00ddc2
MD5 hash:
946494008829d9a7921869d6e596f4fc
SHA1 hash:
c45382f16e972f0486df56dd0b325d064066bfa2
Link:
https://www.unpac.me/results/57f6d881-5e0a-4fb4-a94f-2b0dfb274c3c/
SH256 hash:
b1c537ecb0169bf85512f45ddb95ed25db8efe9620cf9b5b85e8c6be82ef2bb7
MD5 hash:
5812b8faf43abc9a9d00bcc51cf3930b
SHA1 hash:
2346b75d0712238202ffdba54963a723904af375
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/57f6d881-5e0a-4fb4-a94f-2b0dfb274c3c/
SH256 hash:
2462f818e2f8ef9600cd87af7839ba8d19decc3a5a25c0e77c69592b15be3254
MD5 hash:
7e20ac6e3e88c9eb7d7ff99ffed0ab13
SHA1 hash:
313142f2c53a4f9b58ff67c017611c719d6b9729
Link:
https://www.unpac.me/results/57f6d881-5e0a-4fb4-a94f-2b0dfb274c3c/
SH256 hash:
26a5440405edc91fc491d2388eafe7e115c91d817e44918464a260b7a95c889d
MD5 hash:
5bf58618e60a5a0136ac8a95691ca7ed
SHA1 hash:
5e2de7690d24c18ee096cf34fe4f9f808bfb2166
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/57f6d881-5e0a-4fb4-a94f-2b0dfb274c3c/
Parent samples :
60f6042bd8477be0193a8936e98dfd3734ab7a6255a9af5f994265502e71f40b
100be7290e64a47757eb6948933df8aed5f7f824272e142630a691ae6012baaf
c5ba81d4088562466ff6b07b96467f4059d6ea6b1c9cd16e4f387b6227ac6ecc
f2c7e3f9eac170b391e2ad8002d482a021c085f0f98eb7507da9653a9c63f960
93fe733f28063459df03c7d1c73470f36c7ddc848405822059655993a089858d
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/60f6042bd847/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/60f6042bd8477be0193a8936e98dfd3734ab7a6255a9af5f994265502e71f40b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:Formbook
Create hunting rule
Author:kevoreilly
Description:Formbook Payload
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 60f6042bd8477be0193a8936e98dfd3734ab7a6255a9af5f994265502e71f40b

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/10663/

Comments