MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 863ea90bd372975fb74fd3e4b6becc7fce097c40759a3fc486eb09188280fa28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 14
| SHA256 hash: | 863ea90bd372975fb74fd3e4b6becc7fce097c40759a3fc486eb09188280fa28 |
|---|---|
| SHA3-384 hash: | 14a1bbcb0afdbf7fbe7be0f0859f796711837db20bcb6f4b0b39345d5725083033c0d1e760e20098728cbaf167a9b4cf |
| SHA1 hash: | ae10e17b8210ca9bc1c4a8a177cab837954008a0 |
| MD5 hash: | a6e1d294c9d18cbf7cd69f41fb9bb67e |
| humanhash: | kitten-lactose-violet-paris |
| File name: | NEW PO.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 721'408 bytes |
| First seen: | 2025-05-06 08:57:09 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | ef471c0edf1877cd5a881a6a8bf647b9 (74 x Formbook, 33 x Loki, 29 x Loda) |
| ssdeep | 12288:aOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiDm/tmMuEuaBkH3bfMKoifHraIhnag:aq5TfcdHj4fmbQcmxEifxzfeIhag |
| TLSH | T167E423946588CCA2EE527335C07ECF6515793B32CD45AB0C1B89D3566833743AAE2B3E |
| TrID | 33.9% (.EXE) UPX compressed Win32 Executable (27066/9/6) 33.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 13.1% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.6% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| dhash icon | aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla) |
| Reporter |  adrian__luca |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
412
Origin country :
HUVendor Threat Intelligence
Verdict:
Malicious
Score:
99.1%
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Searching for the window
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
autoit compiled-script microsoft_visual_cc packed packed packed packer_detected upx
Verdict:
Malicious
Labled as:
Trojan.Generic
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.Leonem
Status:
Malicious
First seen:
2025-05-01 01:07:48 UTC
File Type:
PE (Exe)
Extracted files:
43
AV detection:
23 of 36 (63.89%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
5/10
Tags:
discovery upx
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
UPX packed file
AutoIT Executable
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
863ea90bd372975fb74fd3e4b6becc7fce097c40759a3fc486eb09188280fa28
MD5 hash:
a6e1d294c9d18cbf7cd69f41fb9bb67e
SHA1 hash:
ae10e17b8210ca9bc1c4a8a177cab837954008a0
SH256 hash:
38ae6c2a5f59cdbc24ddcacb681565231aa372bc2dfd22be4ee7facde9a99ba8
MD5 hash:
8a9b84babc122e5c530b13d8684bc9fc
SHA1 hash:
e53a752e6bb0773f33b2ca1af05fb46afd0c9be0
Detections:
AutoIT_Compiled
SH256 hash:
811ce56a7adaa9180cd0cf56703967fecb1302c08b6df6468a1460526552cd80
MD5 hash:
e68ca81b846f64d41816e136c9605b78
SHA1 hash:
a4d4d0f15ffe1b1f0fff064b129ca678750e119e
SH256 hash:
2caca366d0f40c80dae2003f41eb98787e51cbc6b7985cc3251aa962d53b7fc4
MD5 hash:
50bac6928d7a82861f13dc11a10b180a
SHA1 hash:
60445dceae1c1a7ca234cb040f053d9c860ebcb8
Detections:
win_formbook_g0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DebuggerCheck__GlobalFlags |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Active |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Thread |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | Formbook |
|---|---|
| Author: | kevoreilly |
| Description: | Formbook Payload |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
| Rule name: | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser |
|---|---|
| Author: | malware-lu |
| Rule name: | upx_largefile |
|---|---|
| Author: | k3nr9 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| MULTIMEDIA_API | Can Play Multimedia | WINMM.dll::timeGetTime |
| SECURITY_BASE_API | Uses Security Base API | ADVAPI32.dll::AddAce |
| WIN_BASE_API | Uses Win Base API | KERNEL32.DLL::LoadLibraryA |
| WIN_NETWORK_API | Supports Windows Networking | MPR.dll::WNetUseConnectionW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.