MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bd331cdc84091c9a07dc0455f5bc480fcf7c59853592a31986954ca0415a816. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8bd331cdc84091c9a07dc0455f5bc480fcf7c59853592a31986954ca0415a816
SHA3-384 hash: bcacd367869d42f76fd65ccb7ee87173ca1ae7c6506e461221e2e0a00432bed1da99c48d1c8f1d6e2b4e487ff0bbd36c
SHA1 hash: 6ef228c299ba46decfc4cd8502e35e5a3e5257a5
MD5 hash: 34ce9a01c6492cfdd4e216c2c61127a3
humanhash: lactose-blue-five-saturn
File name:8bd331cdc84091c9a07dc0455f5bc480fcf7c59853592a31986954ca0415a816
Download: download sample
Signature Formbook
Create hunting rule
File size:3'208'704 bytes
First seen:2025-10-10 06:28:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a56f115ee5ef2625bd949acaeec66b76 (57 x PureHVNC, 54 x Stealc, 35 x CoinMiner)
ssdeep 49152:Z9B9AeijiQ11uVMOfRLAkW9sCl0KPGqia67q4RV8DdTo/sGXS:DBojb1gHf7cDPhir64BS
TLSH T1B4E5332637C0C257D8D9D07FDAF3C39681AD1A4AA4C470C6F9F12DEE8464A5493CBA87
TrID 28.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
25.5% (.EXE) Win32 Executable (generic) (4504/4/1)
11.6% (.ICL) Windows Icons Library (generic) (2059/9)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8bd331cdc84091c9a07dc0455f5bc480fcf7c59853592a31986954ca0415a816.exe
Verdict:
Suspicious activity
Analysis date:
2025-10-10 06:34:31 UTC
Tags:
themida
Link:
https://app.any.run/tasks/ce81c1bf-983a-4d26-8cd1-781e8150f258

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/32028/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e8a7e68b7b147cc4b6887b
Tags:
vmdetect packed virus encpk
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm microsoft_visual_cc obfuscated obfuscated overlay packed packed packer_detected themidawinlicense
Link:
https://www.filescan.io/uploads/68e8aaae4f3013c55e4938bf/reports/d9834891-2b24-4eb3-aded-1b75a557f217/overview
Verdict:
Malicious
Labled as:
Fragtor.Generic
Link:
https://www.hybrid-analysis.com/sample/8bd331cdc84091c9a07dc0455f5bc480fcf7c59853592a31986954ca0415a816
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-04T00:16:00Z UTC
Last seen:
2025-10-10T06:29:00Z UTC
Hits:
~100
Detections:
Trojan-Spy.Win32.Noon.sb Trojan-Spy.Win32.Noon.bmsd
Link:
https://opentip.kaspersky.com/8bd331cdc84091c9a07dc0455f5bc480fcf7c59853592a31986954ca0415a816/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/62ce3c20-0ab4-42e2-a01c-447289e4b870
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8bd331cdc84091c9a07dc0455f5bc480fcf7c59853592a31986954ca0415a816
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/34ce9a01c6492cfdd4e216c2c61127a3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8bd331cdc84091c9a07dc0455f5bc480fcf7c59853592a31986954ca0415a816/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/8bd331cdc84091c9a07dc0455f5bc480fcf7c59853592a31986954ca0415a816
Threat name:
Win32.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-09-09 23:48:31 UTC
File Type:
PE (Exe)
AV detection:
27 of 37 (72.97%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rpjtdtoiici4tid5ybcv6w6eqd6pprmyknmsummynfkmubavvala._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook defense_evasion discovery rat spyware stealer themida trojan
Link:
https://tria.ge/reports/251010-hf9lbs1mz4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Program crash
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks whether UAC is enabled
Checks BIOS information in registry
Themida packer
Formbook payload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Formbook
Formbook family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e0d30d83-237d-4a2b-80a9-204fd7e5837f
Unpacked files
SH256 hash:
8bd331cdc84091c9a07dc0455f5bc480fcf7c59853592a31986954ca0415a816
MD5 hash:
34ce9a01c6492cfdd4e216c2c61127a3
SHA1 hash:
6ef228c299ba46decfc4cd8502e35e5a3e5257a5
Link:
https://www.unpac.me/results/4b03eaf0-0adb-40e4-8f5b-42ccd50b1bc0/
SH256 hash:
20b3a7d9d310752688dcda5ac8a4554490eae111ada1b4a4a2ca8f4eab264c80
MD5 hash:
82195e5502c20c51c85eef29d69a3c80
SHA1 hash:
234fc4f0efaa55d928ee287eaada468548df0ed5
Detections:
INDICATOR_EXE_Packed_Themida
Create hunting rule
Link:
https://www.unpac.me/results/4b03eaf0-0adb-40e4-8f5b-42ccd50b1bc0/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8bd331cdc840/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.94
Link:
https://yomi.yoroi.company/submissions/8bd331cdc84091c9a07dc0455f5bc480fcf7c59853592a31986954ca0415a816

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/32028/

Comments