MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64506ae267aed8afa5cfbb41ca8f5677600747f02fe27b8d8d926d12e3ad99f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 14

Intelligence 14 IOCs YARA 7 File information Comments

SHA256 hash:	64506ae267aed8afa5cfbb41ca8f5677600747f02fe27b8d8d926d12e3ad99f2
SHA3-384 hash:	03ac26707287d6e8f46743264cf8216fe9715100826ccfaf0d3027acde552c077d9841f7259ec20e1c6470d52f8618e7
SHA1 hash:	06aebc4b151876e8c1c9e118f90e14aba11b284d
MD5 hash:	596dc288e8914898b0be9d57a0e3d277
humanhash:	alanine-white-venus-finch
File name:	NEW_FLF7997_SHIPMENT_DETAILpdf.com
Download:	download sample
Signature	Formbook Create hunting rule
File size:	855'040 bytes
First seen:	2026-10-08 02:51:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'249 x AgentTesla, 20'536 x Formbook, 12'383 x SnakeKeylogger)
ssdeep	24576:bvCKX8jRLCOo0fQyrQVPwynhO0QE0Bfwh2y:bvCfjg30f9rQVBWto2y
TLSH	T12D05F114331ADC13E56257F00970E37197785ED4A461E3E3CEFBADEBB9A67806809683
TrID	73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	f0e8e8e0f0b2e8e8 (1 x Formbook)
Reporter	threatcat_ch
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

216

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

RoboSki

Details

Link:

https://research.acce.ciphertechsolutions.com/results/45206629-d265-4df8-bc13-0779685db1f8/

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-10-08 02:58:57 UTC

Tags:

netreactor

Link:

https://app.any.run/tasks/e4c390c5-7c94-478a-9f06-384315fe7559

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/91040/

Detection(s):

SecuriteInfo.com.Win32.MalwareX-gen.59295238.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

masquerade packed vbnet

Link:

https://www.filescan.io/uploads/6ac7055e8c912c3b4923c3b6/reports/4517a7dc-a2f2-4125-b852-8912fd441775/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/64506ae267aed8afa5cfbb41ca8f5677600747f02fe27b8d8d926d12e3ad99f2

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-10-07T23:10:00Z UTC

Last seen:

2026-10-07T23:43:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/64506ae267aed8afa5cfbb41ca8f5677600747f02fe27b8d8d926d12e3ad99f2/results?tab=lookup

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/aeb6e163-6ee8-4830-8ca0-f340dd03fbc2

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1983925

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected FormBook

Yara detected MSIL Injector

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/64506ae267aed8afa5cfbb41ca8f5677600747f02fe27b8d8d926d12e3ad99f2

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.24 Win 32 Exe x86

Link:

https://app.malva.re/file/596dc288e8914898b0be9d57a0e3d277

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/64506ae267aed8afa5cfbb41ca8f5677600747f02fe27b8d8d926d12e3ad99f2/

Threat name:

ByteCode-MSIL.Spyware.Negasteal

Status:

Suspicious

First seen:

2026-10-08 02:32:03 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

13 of 36 (36.11%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mrigvythv3mk7jopxna4vd2wo5qaor7qf7rhxdmnsjwrfy5nthza._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan

Link:

https://tria.ge/reports/261008-dcs2ysz19q/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Family: Formbook

Formbook payload

Unpacked files

SH256 hash:

64506ae267aed8afa5cfbb41ca8f5677600747f02fe27b8d8d926d12e3ad99f2

MD5 hash:

596dc288e8914898b0be9d57a0e3d277

SHA1 hash:

06aebc4b151876e8c1c9e118f90e14aba11b284d

Link:

https://www.unpac.me/results/bcb5b5af-d159-467d-90b0-30b1741de6f6/

SH256 hash:

405d0dcbe8454646de26e8b2db78435803b99dccdcbcdaa1028c56c7c0c6c3ec

MD5 hash:

3e3fb75f3074003ae2ff07ecfe6fd38d

SHA1 hash:

5200f5572d3167c84842bbff7c48506011585172

Detections:

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/bcb5b5af-d159-467d-90b0-30b1741de6f6/

Parent samples :

64506ae267aed8afa5cfbb41ca8f5677600747f02fe27b8d8d926d12e3ad99f2
354ed74cf297bdc4d920e3bb357fea7202856277501cbe914b1dfbe8813e841c
7a9bffbf3a920d9b72d73b73cf09f3be5dadf025055f42b5dd12761ab7c8dd34
461ba9a7d6b344421967b3c71630ec4796126b5f20bef32111447ac58e9b9202
a36cbacd3c6950de6319523835e895e8b35e32549c3a4673b3ead5215ad0d3e8
a8a6f5ad5f6bc59b64af1cca3bf0d5b6bcc8686a0dd8a8bb5cb244c2edcf3e23

SH256 hash:

6691e4699cc10f4bd3e0706ace7099b28bac9cac46941726aa0d31d4e591025e

MD5 hash:

af3808971717d2feb61077003f185250

SHA1 hash:

b962c5eadd06f3edcab5cdf623c4f3a594a12bb5

Link:

https://www.unpac.me/results/bcb5b5af-d159-467d-90b0-30b1741de6f6/

SH256 hash:

2fb3b114fae39226e11b418892fd0834ace00ddbc61362bb388e4435fa68b90e

MD5 hash:

2cbd4d6d9fcdbf20661b4aeeeb8f50f8

SHA1 hash:

e56fd8db555406700cbd1400741202b526bdeea0

Link:

https://www.unpac.me/results/bcb5b5af-d159-467d-90b0-30b1741de6f6/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/64506ae267aed8afa5cfbb41ca8f5677600747f02fe27b8d8d926d12e3ad99f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	HUNT_NET_Loader_ImagePixel_To_AssemblyLoad Create hunting rule
Author:	Anish Bogati
Description:	Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Derialock (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

exe 64506ae267aed8afa5cfbb41ca8f5677600747f02fe27b8d8d926d12e3ad99f2

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/91040/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample