MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76f15fc932f10a906c12545494d90aa643156e753001be2d47cd39b9168efb7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 14

Intelligence 14 IOCs YARA 11 File information Comments

SHA256 hash:	76f15fc932f10a906c12545494d90aa643156e753001be2d47cd39b9168efb7c
SHA3-384 hash:	e8e525d5a97cab15ec1f677c47c1f0668e513c634cd67884b33d50936a503c910a54f37a5a5197e7520f2e8cafe01071
SHA1 hash:	686020a9e2e80811a25596f6c06c5470c96a0735
MD5 hash:	44a136585bd2be8bc492739090a547e2
humanhash:	fix-november-violet-beryllium
File name:	Quotation.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'558'528 bytes
First seen:	2026-05-20 17:50:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	91d07a5e22681e70764519ae943a5883 (144 x Formbook, 35 x AgentTesla, 32 x a310Logger)
ssdeep	24576:/tb20pkaCqT5TBWgNQ7avthte4XKyQanlj1DB9CQ36A:8Vg5tQ7a3A4Hj1DB9C25
Threatray	2'740 similar samples on MalwareBazaar
TLSH	T1B575DF2227EDC266C372027379A5F726AE7F6D241DA5F5532F942C7CBD30760260A263
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	0cacc0c4b0944c10 (54 x Formbook, 4 x AgentTesla)
Reporter	TomU
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

AutoIt AutoStones FormBook

Details

AutoIt

extracted scripts and files

AutoStones

the names of side-loaded components and, if available from processing of a parent file, the deobfuscated components

FormBook

a decrypted component and its RC4 key

Link:

https://research.acce.ciphertechsolutions.com/results/4ba5a20e-5dfc-4a80-a43d-26173bea266a/

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-05-21 01:05:24 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/48db0cae-5668-410f-9758-0a9ed5e1bc43

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/66898/

Detection(s):

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a0e08224f2b29ce04020a57

Tags:

autoit emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Sending a custom TCP request

Сreating synchronization primitives

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script fingerprint keylogger microsoft_visual_cc reconnaissance redcap

Link:

https://www.filescan.io/uploads/6a0df9daefbd399b39c023ee/reports/e10f1090-8c82-4639-9013-974e06042cfe/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/76f15fc932f10a906c12545494d90aa643156e753001be2d47cd39b9168efb7c

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-05-12T09:33:00Z UTC

Last seen:

2026-05-21T17:13:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/76f15fc932f10a906c12545494d90aa643156e753001be2d47cd39b9168efb7c/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/10bbed31-0302-4405-b94d-16eae1db2913

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/76f15fc932f10a906c12545494d90aa643156e753001be2d47cd39b9168efb7c

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/76f15fc932f10a906c12545494d90aa643156e753001be2d47cd39b9168efb7c/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-05-12 13:28:20 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

31 of 38 (81.58%)

Threat level:

5/5

Verdict:

malicious

Label(s):

formbook

autoit

unc_loader_036

Formbook

6e88c46365728a18e94c83dec360d06e6fd77fb72a78132292dfe1240e9dbe8f

Formbook

73dafff95640b7ab25cf78c3761448ae1ac0777df5ab6037e37b5ec9b7bd1f96

Formbook

7e58dcee3885cb1d7561fcc9aebdcb8b74bf0d876116a88ac4fbf107ab86559a

Formbook

a46fbf2a22d696f5e2311d8f3276c2096d7dd29e427fffa26694d724ae74b412

Formbook

a4eac1a2891f56f37dbc860c6b56e8cd8d59972cd7faaf643854cb8860ca3d29

Formbook

d4980a2c4b12511d3b4d42b321f438d239772eae4ea9806f3b2ffc11f707bbd6

Formbook

fd1e2959982beba4b7304b953d3190a852d8c3f730373bac988fb697a917d5af

Formbook

+ 2'730 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan

Link:

https://tria.ge/reports/260520-wfja2ah19w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Family: Formbook

Formbook payload

Unpacked files

SH256 hash:

76f15fc932f10a906c12545494d90aa643156e753001be2d47cd39b9168efb7c

MD5 hash:

44a136585bd2be8bc492739090a547e2

SHA1 hash:

686020a9e2e80811a25596f6c06c5470c96a0735

Link:

https://www.unpac.me/results/d036e8b3-946b-425a-81ac-61e24179db5d/

SH256 hash:

0823f2bbf151bc8f13ff90b3d3dcdc858de21b5d9db2e2f1c4b4c60dc5cec557

MD5 hash:

fc23fb330638af03463d039b573ec638

SHA1 hash:

f74cb9732f4fc3dd66af60eab4892e0c8c363a20

Link:

https://www.unpac.me/results/d036e8b3-946b-425a-81ac-61e24179db5d/

SH256 hash:

40c32f367ea8ded828c04b4b2c70edaca2cd5983df5eec180b95275f86b466b9

MD5 hash:

6d734c4c54dbc8e5f2f465a8a4a990f4

SHA1 hash:

365949330fa9ddaf27cd3c2cb76595eaf65ffa80

Detections:

win_formbook_g0

triage_formbook

Link:

https://www.unpac.me/results/d036e8b3-946b-425a-81ac-61e24179db5d/

Parent samples :

385daa6df4e6c93c6402e26459810c3217594916607de466f152d0e4a6b6c1e8
d4980a2c4b12511d3b4d42b321f438d239772eae4ea9806f3b2ffc11f707bbd6
a46fbf2a22d696f5e2311d8f3276c2096d7dd29e427fffa26694d724ae74b412
bdb09ef0e9df2db61940a43c8e9b474c3fe865e6bf432de12050fbef9547eb6e
7e58dcee3885cb1d7561fcc9aebdcb8b74bf0d876116a88ac4fbf107ab86559a
d4b7c4546aa9faa318db82d328bd3dfa9328afde05ffd3af725fa52483f4909b
6e88c46365728a18e94c83dec360d06e6fd77fb72a78132292dfe1240e9dbe8f
c49dcbdc71e27b8c24bd8f18630b0d4cc7a8f209287da01067875d04d5ef2e4d
76f15fc932f10a906c12545494d90aa643156e753001be2d47cd39b9168efb7c

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/76f15fc932f10a906c12545494d90aa643156e753001be2d47cd39b9168efb7c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	YahLover Create hunting rule
Author:	Kevin Falcoz
Description:	YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

exe 76f15fc932f10a906c12545494d90aa643156e753001be2d47cd39b9168efb7c

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/66898/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample