MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b32f0d7aef7046e3d48633a0d759e64f86b9d3ccc9eb7b7f12fc5733ddf27d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b32f0d7aef7046e3d48633a0d759e64f86b9d3ccc9eb7b7f12fc5733ddf27d4
SHA3-384 hash: c98b91263038ce5ea11f3de56a1ecf4418deb02d5539e810fc47ac647904aae436d390a97aaab30febd1cfd92d2282af
SHA1 hash: dd76772714422888b52eebeeaa91669ba52ec08d
MD5 hash: dd71a4e1f9223545aa723c7be6f6d70d
humanhash: pasta-pennsylvania-hydrogen-lima
File name:#Brazil-098484OBZ.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'100'288 bytes
First seen:2026-07-23 10:13:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'122 x AgentTesla, 20'134 x Formbook, 12'360 x SnakeKeylogger)
ssdeep 24576:5p50cqngfyxNrJUCRJ8wRFw41L2Y00L2d5Oc6/5:5pUg4rJUCRCfd5Oc6/
TLSH T1623501542215DE02E4DA87F6B9A0E33433B54ECF39E1D3A26FE56FF738293815A54281
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter threatcat_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
222
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/7a32ad58-196f-4c48-92dd-8ea0878b50a3/
Malware family:
n/a
ID:
1
File name:
formbook_test_process_tree.exe
Verdict:
No threats detected
Analysis date:
2026-07-23 10:35:58 UTC
Tags:
netreactor
Link:
https://app.any.run/tasks/25641128-6889-4d1e-a6d5-92f8befa3f4f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75784/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.64325427.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Launching a service
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6a61e949be5fa5bfa93118cb/reports/8c4f275f-47be-4af9-9cbc-3dcead84398d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/8b32f0d7aef7046e3d48633a0d759e64f86b9d3ccc9eb7b7f12fc5733ddf27d4
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-23T04:32:00Z UTC
Last seen:
2026-07-23T06:54:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/8b32f0d7aef7046e3d48633a0d759e64f86b9d3ccc9eb7b7f12fc5733ddf27d4/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0d5f1c6e-38fa-4d7e-841b-0afdf1aff0ce
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1946990
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Yara detected FormBook
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1946990 Sample: #Brazil-098484OBZ.exe Startdate: 23/07/2026 Architecture: WINDOWS Score: 100 31 www.789700420.xyz 2->31 33 www.zzwinu6.com 2->33 35 22 other IPs or domains 2->35 43 Suricata IDS alerts for network traffic 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 Yara detected FormBook 2->47 51 4 other signatures 2->51 10 #Brazil-098484OBZ.exe 3 2->10         started        signatures3 49 Performs DNS queries to domains with low reputation 31->49 process4 file5 29 C:\Users\user\...\#Brazil-098484OBZ.exe.log, ASCII 10->29 dropped 61 Unusual module load detection (module proxying) 10->61 63 Switches to a custom stack to bypass stack traces 10->63 14 #Brazil-098484OBZ.exe 10->14         started        17 #Brazil-098484OBZ.exe 10->17         started        signatures6 process7 signatures8 65 Modifies the context of a thread in another process (thread injection) 14->65 67 Maps a DLL or memory area into another process 14->67 69 Queues an APC in another process (thread injection) 14->69 71 Found direct / indirect Syscall (likely to bypass EDR) 14->71 19 U4v3qMrh.exe 14->19 injected process9 process10 21 fsutil.exe 13 19->21         started        signatures11 53 Tries to steal Mail credentials (via file / registry access) 21->53 55 Tries to harvest and steal browser information (history, passwords, etc) 21->55 57 Modifies the context of a thread in another process (thread injection) 21->57 59 3 other signatures 21->59 24 7nWrmtVEgoEk.exe 21->24 injected 27 firefox.exe 21->27         started        process12 dnsIp13 37 789700420.xyz 162.0.232.107, 49766, 49767, 49768 NAMECHEAP-NET-NamecheapIncUS United States 24->37 39 www.boldco.life 192.64.118.221, 49746, 49747, 49748 NAMECHEAP-NET-NamecheapIncUS United States 24->39 41 12 other IPs or domains 24->41
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8b32f0d7aef7046e3d48633a0d759e64f86b9d3ccc9eb7b7f12fc5733ddf27d4
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8b32f0d7aef7046e3d48633a0d759e64f86b9d3ccc9eb7b7f12fc5733ddf27d4/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Suspicious
First seen:
2026-07-23 10:14:52 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rmzpbv5o64cg4pkimm5a25m6mt4gxhj4zsplpn7rf7cxgpo7e7ka._file
Verdict:
malicious
Label(s):
Formbook
Create hunting rule
Link:
https://reports.threatray.com/a9dfdb89-d722-4d7f-8563-bb063d910278
Similar samples:
053b117e9ed3d97ed109590d414e1db9321475564e8ecd120221a56610b05c0c
Formbook
4f0925945aedb397ad3cbdd0e9b9a3ebf96d64c242699a971c2c016636383569
Formbook
764432a2592954ad4cf70f8c62b46ee81e55457b66b972e77de3e51017c02b10
Formbook
7f74240c041dde0a5a11382cd2142e22d7fcea25bc48566c98b1e153388f8cc6
Formbook
8b32f0d7aef7046e3d48633a0d759e64f86b9d3ccc9eb7b7f12fc5733ddf27d4
Formbook
e967a74505018f5a4de19d45bb69634ecdb8524f444f385f3be6957411095229
Formbook
ef8f821a54f3f07ae8036c005c7656aa755f8078de6c70a1a8f72ebafe35fe69
Formbook
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/260723-l9bg6shl3s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
8b32f0d7aef7046e3d48633a0d759e64f86b9d3ccc9eb7b7f12fc5733ddf27d4
MD5 hash:
dd71a4e1f9223545aa723c7be6f6d70d
SHA1 hash:
dd76772714422888b52eebeeaa91669ba52ec08d
Link:
https://www.unpac.me/results/8c4f3cdf-8861-47d0-bfbf-ceb237baf67a/
SH256 hash:
e4e98c56847f65b0ec79dd0fcd73f780be8e5b64a78def50b3d447c6a22aab6d
MD5 hash:
3e279146474e41a20e10d71196dea18c
SHA1 hash:
c3abd761f47fc10a6e546d214517de85e1cb64a0
Link:
https://www.unpac.me/results/8c4f3cdf-8861-47d0-bfbf-ceb237baf67a/
SH256 hash:
ab89d4e048e77f0ba0147c214aa0829e6e8dd3f358fbb38da855aaba7932a4c3
MD5 hash:
0b26a36cc5164ce3989ad2c047efc4f0
SHA1 hash:
fb3272c29b083ef3e67dfe242dc5e5e3322fdc8a
Link:
https://www.unpac.me/results/8c4f3cdf-8861-47d0-bfbf-ceb237baf67a/
SH256 hash:
c53c54158af280a5be9a481deef57f77e6215c1eea433b2fb373420ed915bc4f
MD5 hash:
559cd1126dca0f29f681c2e33da36664
SHA1 hash:
84d125f6b9873bb0d5c0f6fb4e554631784bc423
Link:
https://www.unpac.me/results/8c4f3cdf-8861-47d0-bfbf-ceb237baf67a/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8b32f0d7aef7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8b32f0d7aef7046e3d48633a0d759e64f86b9d3ccc9eb7b7f12fc5733ddf27d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 8b32f0d7aef7046e3d48633a0d759e64f86b9d3ccc9eb7b7f12fc5733ddf27d4

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/75784/

Comments