MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 740117685e5ab345b8b786c7ee3127875dfea865c385ecb96296e9c2fad96dcb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 17
| SHA256 hash: | 740117685e5ab345b8b786c7ee3127875dfea865c385ecb96296e9c2fad96dcb |
|---|---|
| SHA3-384 hash: | 60d776a3a5c93556bc4c7132accc60250b73bf41f18224ca6c7022aa7b6aa7d5ab7ddd3a9f5c4c1162e90b83d51c69a9 |
| SHA1 hash: | 3f32a2a50a9c4817a4c3686b247c34890c1d412e |
| MD5 hash: | 81ee4c1ab6ec54d58313f7714b1ecc6d |
| humanhash: | wisconsin-delaware-louisiana-harry |
| File name: | PAYMENT 2.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 1'058'304 bytes |
| First seen: | 2026-02-24 14:28:25 UTC |
| Last seen: | 2026-02-25 01:23:39 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'829 x AgentTesla, 19'759 x Formbook, 12'295 x SnakeKeylogger) |
| ssdeep | 24576:pQlbCPu5x+bVqPFc61a+llb1kzxNAHH8Hsj:p0OPu5xeVqX1NHOzwosj |
| Threatray | 2'695 similar samples on MalwareBazaar |
| TLSH | T1743501686B61CB06D8E65B341771F6741BB95EEEB811E20B4FE8BDDBB522B148C04343 |
| TrID | 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| Reporter |  James_inthe_box |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
3
# of downloads :
187
Origin country :
USVendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Malware family:
n/a
ID:
1
File name:
_740117685e5ab345b8b786c7ee3127875dfea865c385ecb96296e9c2fad96dcb.exe
Verdict:
Malicious activity
Analysis date:
2026-02-24 14:29:42 UTC
Tags:
auto-startup susp-lnk
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Verdict:
Malicious
Score:
94.9%
Tags:
stration autorun shell spawn
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
krypt masquerade packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Verdict:
Malicious
File Type:
exe x32
Detections:
HEUR:Trojan-Dropper.MSIL.Scrop.gen Backdoor.Agent.HTTP.C&C Trojan-Spy.Noon.HTTP.ServerRequest Trojan.Win32.Agent.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb Trojan.MSIL.Agent.sb PDM:Trojan.Win32.Generic
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.22 Win 32 Exe x86
Verdict:
Malicious
Threat:
Family.FORMBOOK
Threat name:
Win32.Trojan.PhantomStealer
Status:
Malicious
First seen:
2026-02-24 08:39:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
21 of 38 (55.26%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'685 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Drops startup file
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Unpacked files
SH256 hash:
740117685e5ab345b8b786c7ee3127875dfea865c385ecb96296e9c2fad96dcb
MD5 hash:
81ee4c1ab6ec54d58313f7714b1ecc6d
SHA1 hash:
3f32a2a50a9c4817a4c3686b247c34890c1d412e
SH256 hash:
e9d64fd68485be88c509cd337eafe6d8e3d1efa9abb405214c1a56697b26ed66
MD5 hash:
8d112b0be5b435844e7c1d8ffd94907f
SHA1 hash:
2677d1b9c444cbc76c70c627cfd6dab0b2ecc570
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SH256 hash:
85bb8ef5c4fac99e6de28220bd7c79ae48a772502476b8d986b3c7583ba050d8
MD5 hash:
0ed556f6302b2955e576c6701284d5ec
SHA1 hash:
91581f0e3418fe20d4b1bb5cfd1c3d12c065f043
SH256 hash:
7e1ad413becb342eab79a517ed8a986d01ef6234248f837b5cce16df255cfcd5
MD5 hash:
fe6918a61784ffe8063e996735293a1e
SHA1 hash:
d4c22969c56656ac95227680eb1fe8d7d7d55bd8
SH256 hash:
8af680ece04e5bcd194a7a4581fe787610e005ddf439fb40a25c9bf0005aa568
MD5 hash:
b95abdf96bd0b15332814b06c8fa2358
SHA1 hash:
a718034673b735f40b341866036d646790d05e44
Detections:
win_formbook_g0
Malware family:
FormBook
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.