MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 626264a78556f96610652533d7c99b1cb354561abe5042360fbca5e332b3f3ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 626264a78556f96610652533d7c99b1cb354561abe5042360fbca5e332b3f3ce
SHA3-384 hash: 5422d5932e8862fa171fb65449d24e6e1c8d991f3afa68584ef7179a2c3f41a7b772ed955d8cc51adf09f5e5019e52af
SHA1 hash: 1b08499fa0e7487dd5cab3d34931e486d06a2e36
MD5 hash: ef6e69eec26b9f6e31c9004ee9baf4ce
humanhash: mobile-wyoming-delaware-floor
File name:New Order.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:719'872 bytes
First seen:2025-05-13 13:52:20 UTC
Last seen:2025-05-19 09:12:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ef471c0edf1877cd5a881a6a8bf647b9 (74 x Formbook, 33 x Loki, 29 x Loda)
ssdeep 12288:nOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiI06p8pLzvRuIFMYC9lVwOF9dNPAba:nq5TfcdHj4fmbFpMLzvrFC9wgzoba
Threatray 2'177 similar samples on MalwareBazaar
TLSH T167E423A02180CCA1EA313271D0BBCFD61A797D72CD51278D4B99E169A83234399D7A3E
TrID 33.9% (.EXE) UPX compressed Win32 Executable (27066/9/6)
33.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
13.1% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.6% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
495
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
New Order.exe
Verdict:
No threats detected
Analysis date:
2025-05-13 14:04:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e0f5bb45-4ea4-48c2-8d1f-6a13ea1d239a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Dropper.DarkKomet-9976062-0
Create hunting rule

SecuriteInfo.com.W32.Trojan.VORE-2106.1542.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=682350424a59e5a2ce0435c7
Tags:
virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
autoit compiled-script darkkomet evasive fingerprint lolbin masquerade microsoft_visual_cc netsh packed packed packed packer_detected phishing upx
Link:
https://www.filescan.io/uploads/68234ed00e6398962582d65a/reports/0a40346a-3121-4a77-93de-130c5b3c329a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/626264a78556f96610652533d7c99b1cb354561abe5042360fbca5e332b3f3ce
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5d06207c-5724-45fa-8425-88188a570ed4
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1688990
Signature
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1688990 Sample: New Order.exe Startdate: 13/05/2025 Architecture: WINDOWS Score: 100 28 www.tieniu09.xyz 2->28 30 www.servisyeni.xyz 2->30 32 15 other IPs or domains 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Antivirus detection for URL or domain 2->44 46 Multi AV Scanner detection for submitted file 2->46 50 5 other signatures 2->50 10 New Order.exe 2 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 30->48 process4 signatures5 62 Binary is likely a compiled AutoIt script file 10->62 64 Writes to foreign memory regions 10->64 66 Maps a DLL or memory area into another process 10->66 13 svchost.exe 10->13         started        process6 signatures7 68 Maps a DLL or memory area into another process 13->68 16 OyJbcH0A.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 dxdiag.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 OyJbcH0A.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.turbonest.live 199.192.23.195, 49743, 49744, 49745 NAMECHEAP-NETUS United States 22->34 36 www.jinzebengye.net 165.3.35.228, 49718, 49719, 49721 PEGTECHINCUS South Africa 22->36 38 6 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/626264a78556f96610652533d7c99b1cb354561abe5042360fbca5e332b3f3ce
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/626264a78556f96610652533d7c99b1cb354561abe5042360fbca5e332b3f3ce/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-05-09 02:00:15 UTC
File Type:
PE (Exe)
Extracted files:
51
AV detection:
26 of 35 (74.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mjrgjj4fk34wmedfeuz5psm3dszvivq2xzieenqpxss6gmvt6pha._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
unc_loader_036
Create hunting rule
autoit
Create hunting rule
Similar samples:
15bc22a6c44ef58907ba89ec4068eeb3b627148df385e0535fdc318107e71d66
Formbook
1791410cac40d8b4d76b569f1db728502164124881a5555a769c68eaca19ccb4
Formbook
63d9db1d6ad43b29d1dc245eead5fea3cf85ab49815984bb531f74d80bf0d4e6
Formbook
8393b72386d26ce3ba3d0b0abc1f28589c099634bad87647808baee320a8269a
Formbook
85bebafe85fe41c6286aa08ab3378ad7fcb6b4c4a05c8d41d595d331815d5a2f
Formbook
863ea90bd372975fb74fd3e4b6becc7fce097c40759a3fc486eb09188280fa28
Formbook
ae2f77ad311caf919d2c2ed85c691d9906185b06b01d153d49bfa8ddb132ee3d
Formbook
e4fc84d04575c5195309cf9c27d1ef3f0eac085bfc3d813380fe1802c6677e4a
Formbook
e5181d3fdd28f4bde089c8b46a2d6afc84039769700257c3305b51ca0a7da931
Formbook
+ 2'167 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery upx
Link:
https://tria.ge/reports/250513-q65n3abq3z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Verdict:
Malicious
Tags:
Win.Dropper.DarkKomet-9976062-0
YARA:
n/a
Link:
https://app.threat.zone/submission/941d7e78-d807-4864-980a-28505ad0da20
Unpacked files
SH256 hash:
626264a78556f96610652533d7c99b1cb354561abe5042360fbca5e332b3f3ce
MD5 hash:
ef6e69eec26b9f6e31c9004ee9baf4ce
SHA1 hash:
1b08499fa0e7487dd5cab3d34931e486d06a2e36
Link:
https://www.unpac.me/results/3478fe1d-e0c6-4b64-99ce-21725e3032aa/
SH256 hash:
a404b99ecca7e97fc1bb461722f6692dbfdf15949c33773212a0a17385d9f1fc
MD5 hash:
9ce0b9a23e63d0c3bc839443dace4dd8
SHA1 hash:
395aa665766f3a685a75a1dee9c5eef9a005a32f
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/3478fe1d-e0c6-4b64-99ce-21725e3032aa/
SH256 hash:
811ce56a7adaa9180cd0cf56703967fecb1302c08b6df6468a1460526552cd80
MD5 hash:
e68ca81b846f64d41816e136c9605b78
SHA1 hash:
a4d4d0f15ffe1b1f0fff064b129ca678750e119e
Link:
https://www.unpac.me/results/3478fe1d-e0c6-4b64-99ce-21725e3032aa/
SH256 hash:
2caca366d0f40c80dae2003f41eb98787e51cbc6b7985cc3251aa962d53b7fc4
MD5 hash:
50bac6928d7a82861f13dc11a10b180a
SHA1 hash:
60445dceae1c1a7ca234cb040f053d9c860ebcb8
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/3478fe1d-e0c6-4b64-99ce-21725e3032aa/
Parent samples :
863ea90bd372975fb74fd3e4b6becc7fce097c40759a3fc486eb09188280fa28
626264a78556f96610652533d7c99b1cb354561abe5042360fbca5e332b3f3ce
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/626264a78556/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/626264a78556f96610652533d7c99b1cb354561abe5042360fbca5e332b3f3ce

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:Formbook
Create hunting rule
Author:kevoreilly
Description:Formbook Payload
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 626264a78556f96610652533d7c99b1cb354561abe5042360fbca5e332b3f3ce

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetUseConnectionW

Comments