MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7f9d39908a024cc37cdece4ecc8aa724695ee2873d80ed4b1e7f8f8f3ee7ed5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 13
| SHA256 hash: | 7f9d39908a024cc37cdece4ecc8aa724695ee2873d80ed4b1e7f8f8f3ee7ed5d |
|---|---|
| SHA3-384 hash: | 0505acdb9bf01b33fd45f936b23eee9d811c85dc840dba183720d7114504a950d4d148ade807a802b31017aa385c2a8f |
| SHA1 hash: | e2015ac4f699a07f7ea4c3ae9acfa930640fb965 |
| MD5 hash: | f4b48496321018ee16c919231621c13b |
| humanhash: | four-uniform-floor-arizona |
| File name: | z65PaymentReceipt_0002795_1749618415400_pdf.scr |
| Download: | download sample |
| Signature | Formbook |
| File size: | 1'088'512 bytes |
| First seen: | 2026-02-05 00:30:18 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'795 x AgentTesla, 19'693 x Formbook, 12'274 x SnakeKeylogger) |
| ssdeep | 24576:5PiTkw/IwLT3KwbyM/n9oRWrMhEzdCfGddSka:5KTkw/Pb9oRWIhKwE |
| Threatray | 2'637 similar samples on MalwareBazaar |
| TLSH | T10D3512D82280C413CCA9C37C15B1D27547794C9ED961C292AFEEFDE375A47DEA808DA2 |
| TrID | 35.4% (.EXE) Win64 Executable (generic) (10522/11/4) 22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.1% (.EXE) Win32 Executable (generic) (4504/4/1) 6.9% (.ICL) Windows Icons Library (generic) (2059/9) 6.8% (.EXE) OS/2 Executable (generic) (2029/13) |
| Magika | pebin |
| Reporter |  FXOLabs |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
121
Origin country :
BRVendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Malware family:
n/a
ID:
1
File name:
z65PaymentReceipt_0002795_1749618415400_pdf.scr
Verdict:
No threats detected
Analysis date:
2026-02-05 00:32:11 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Verdict:
Malicious
Score:
90.2%
Tags:
agenttesla underscore
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-02-04T14:36:00Z UTC
Last seen:
2026-02-06T17:07:00Z UTC
Hits:
~100
Detections:
HEUR:Trojan-Spy.MSIL.BPLogger.gen Trojan-Spy.Win32.Noon.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb
Verdict:
Unknown
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.23 Win 32 Exe x86
Verdict:
Malicious
Threat:
Family.FORMBOOK
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'627 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Unpacked files
SH256 hash:
7f9d39908a024cc37cdece4ecc8aa724695ee2873d80ed4b1e7f8f8f3ee7ed5d
MD5 hash:
f4b48496321018ee16c919231621c13b
SHA1 hash:
e2015ac4f699a07f7ea4c3ae9acfa930640fb965
SH256 hash:
7d275fc770abe73a59441dae206b95455c5d56ff998b9688e5c1b71e4c8fc92e
MD5 hash:
291851caa7a8f194783c68ad06f695c9
SHA1 hash:
26905685b548aca046b75a5129a3a005d5a0a88c
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Parent samples :
77e10fce419cf22127e04f301914bf28f0511a23380221059522d06d15007d90
aa44a570abbebe8ef664a2ddd4466fd075bf595572e4c2c37f089182e79f364f
823e02bde8acad7fd8fb24bd0f5628fcf9faacbe61efed1d47dd115ec63b55f9
aaefbeec8082e0205165604275b5f7fd9e5d9c75de06e97ec157a081fed3b57a
086a8fb7b92306c495fc562bff32642b856edfc1077ed7c00956ae59363a0fb1
046c2cefcb304a84206b4d598b07b947ffbe7786d6df1048750c2fb08f224352
7f9d39908a024cc37cdece4ecc8aa724695ee2873d80ed4b1e7f8f8f3ee7ed5d
aa44a570abbebe8ef664a2ddd4466fd075bf595572e4c2c37f089182e79f364f
823e02bde8acad7fd8fb24bd0f5628fcf9faacbe61efed1d47dd115ec63b55f9
aaefbeec8082e0205165604275b5f7fd9e5d9c75de06e97ec157a081fed3b57a
086a8fb7b92306c495fc562bff32642b856edfc1077ed7c00956ae59363a0fb1
046c2cefcb304a84206b4d598b07b947ffbe7786d6df1048750c2fb08f224352
7f9d39908a024cc37cdece4ecc8aa724695ee2873d80ed4b1e7f8f8f3ee7ed5d
SH256 hash:
1e322a8c05207d82d7b1a466f7da2a752698c093ced050b4dcb196568793569a
MD5 hash:
561e303a7cccab1748c8bfb28ce6584e
SHA1 hash:
b3388f32f35113666c67bf0f3032d605828d4dd0
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SH256 hash:
639877047e5e57dc6b3a67fc742b21547db42dbf2a6e59b9df34587d2d537f05
MD5 hash:
9cb0f45c168137a69ba163f7f900c314
SHA1 hash:
ebeba2c37b11bbbfe60fe83e86e64c15337e8a0d
SH256 hash:
905b1b7f181a0d8eaef25c54bef9277d1cf175bf381b37ee9e716e4de652b651
MD5 hash:
258391be18bec98f87a9e256bd32a066
SHA1 hash:
401ecce5c0a519a66bc377e0e0c62fddb7f85855
Detections:
win_formbook_g0
Malware family:
FormBook
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.