MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8cbf5d97770dedc4bc8ca8cc5cd745900e0524d6d4ecb5db43de5efe87250b75. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 22 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8cbf5d97770dedc4bc8ca8cc5cd745900e0524d6d4ecb5db43de5efe87250b75
SHA3-384 hash: 89566803ac2faf1c2232b5eb9f87b3c6b1b1fe0c6691129d691dabaa5d22be2fa4139f3ce2b7e949ddf77fd8f4e5bc84
SHA1 hash: cd4cb5147b9d7b036f9abba12137257337be9cf1
MD5 hash: 84cc861a1dc0b6a53e894f0b913c7154
humanhash: oxygen-artist-pip-triple
File name:NEW PO NO 879354.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'199'104 bytes
First seen:2025-06-16 14:09:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:Htb20pkaCqT5TBWgNQ7axjOY7dxAp4eKWLch6A:EVg5tQ7axjOYSXn85
Threatray 2'374 similar samples on MalwareBazaar
TLSH T1B945CF2363DE8365C3725273BA25B741BE7F782506A5F96B2FD4093DE820122521EB73
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
591
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
NEW PO NO 879354.exe
Verdict:
No threats detected
Analysis date:
2025-06-16 14:39:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/34863abb-4354-412a-ba46-d4e22966203e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/9698/
Detection(s):
SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=685025948bd5d68a12e8e17e
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug autoit compiled-script evasive explorer extrac32 fingerprint fingerprint hacktool keylogger lolbin microsoft_visual_cc netsh packed packed packer_detected
Link:
https://www.filescan.io/uploads/68502599985349514e640f62/reports/7f507bfd-d3f1-4d34-8336-e6b4194fd261/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/8cbf5d97770dedc4bc8ca8cc5cd745900e0524d6d4ecb5db43de5efe87250b75
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7110e7df-8cc2-45d1-a36d-d2f562a53dd8
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1715612
Signature
Binary is likely a compiled AutoIt script file
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1715612 Sample: NEW PO NO 879354.exe Startdate: 16/06/2025 Architecture: WINDOWS Score: 100 31 www.prestigeapp.xyz 2->31 33 www.miyue457.xyz 2->33 35 19 other IPs or domains 2->35 43 Suricata IDS alerts for network traffic 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 Yara detected FormBook 2->47 51 3 other signatures 2->51 11 NEW PO NO 879354.exe 4 2->11         started        signatures3 49 Performs DNS queries to domains with low reputation 33->49 process4 signatures5 61 Binary is likely a compiled AutoIt script file 11->61 63 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 11->63 65 Writes to foreign memory regions 11->65 67 Maps a DLL or memory area into another process 11->67 14 svchost.exe 11->14         started        process6 signatures7 69 Maps a DLL or memory area into another process 14->69 17 wQYrhApM.exe 14->17 injected process8 process9 19 cleanmgr.exe 13 17->19         started        signatures10 53 Tries to steal Mail credentials (via file / registry access) 19->53 55 Tries to harvest and steal browser information (history, passwords, etc) 19->55 57 Modifies the context of a thread in another process (thread injection) 19->57 59 3 other signatures 19->59 22 8n6xHyGvLX.exe 19->22 injected 25 chrome.exe 19->25         started        27 firefox.exe 19->27         started        process11 dnsIp12 37 sofiadev.tech 144.172.97.86, 49748, 49749, 49750 PONYNETUS United States 22->37 39 stratoconsulting.tech 84.32.84.32, 49728, 49729, 49730 NTT-LT-ASLT Lithuania 22->39 41 10 other IPs or domains 22->41 29 WerFault.exe 4 25->29         started        process13
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8cbf5d97770dedc4bc8ca8cc5cd745900e0524d6d4ecb5db43de5efe87250b75
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8cbf5d97770dedc4bc8ca8cc5cd745900e0524d6d4ecb5db43de5efe87250b75/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-06-16 14:08:48 UTC
File Type:
PE (Exe)
Extracted files:
24
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rs7v3f3xbxw4jpemvdgfzv2fsahakjgw2twllw2d3zpp5bzfbn2q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
autoit
Create hunting rule
unc_loader_036
Create hunting rule
Similar samples:
38e65102a6d8af117d96ba3159ab096d2b95ea8615408667997ce1375c00f35e
Formbook
5bf3c820c4ed7b2b2e38dec099a4b76273a4e82472ced8f9cad59ba37b02dcb1
Formbook
61d6bc63a0a6db062dd3f42a6ae0dec0a8990d445200660ce6346047128c2cc3
Formbook
8cbf5d97770dedc4bc8ca8cc5cd745900e0524d6d4ecb5db43de5efe87250b75
Formbook
d2e4942924fa6f218f70772eefd5ef57ae369799ba23cd70913f4d0b8fd6da94
Formbook
error
Formbook
+ 2'364 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/250616-rf9qrsyq19/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0bc189e3-ac0c-40cc-bc66-475b2b95f85c
Unpacked files
SH256 hash:
8cbf5d97770dedc4bc8ca8cc5cd745900e0524d6d4ecb5db43de5efe87250b75
MD5 hash:
84cc861a1dc0b6a53e894f0b913c7154
SHA1 hash:
cd4cb5147b9d7b036f9abba12137257337be9cf1
Link:
https://www.unpac.me/results/6e813ef1-30d3-4c77-8d53-6587442c43c5/
SH256 hash:
6d6e400a29e2dc8c6c5ede93e789f9e5ed22cc45ea342fcf6f2f808221a5818f
MD5 hash:
174dc227f18892598264cfc620797acf
SHA1 hash:
a9025d6850ebdc1e4987a25a9ec2799ac464c8fc
Link:
https://www.unpac.me/results/6e813ef1-30d3-4c77-8d53-6587442c43c5/
SH256 hash:
56f71a8da2d26dde4c2ca15d1b5ff22a39de7f09f2cfc84c6ebad75f26c31577
MD5 hash:
3388116e83535055a06384e1f9d97f96
SHA1 hash:
f749a3329d5628d35665dcaf848aea50025de554
Link:
https://www.unpac.me/results/6e813ef1-30d3-4c77-8d53-6587442c43c5/
Parent samples :
38e65102a6d8af117d96ba3159ab096d2b95ea8615408667997ce1375c00f35e
5bf3c820c4ed7b2b2e38dec099a4b76273a4e82472ced8f9cad59ba37b02dcb1
61d6bc63a0a6db062dd3f42a6ae0dec0a8990d445200660ce6346047128c2cc3
adb3ace893f661c1578e335b5247414f87c554922d47660b223c52b3cdb79649
adf664c4bba9af7873a7aa41ee0f2264e2757f14d8ac6619194572b58c1e7e68
2fbeb147acc6a400fdf52595966a38c61f6b323536d9a244de11067c9da57610
f0a905542b77b1e9d101dff1115070bffd1871f4c2ada0f3a95ee21081e8c671
3d4b7da0e29cdd7948064dd1a63fe86401240716d54ab1ef4d6e234e0b66807e
4857ee7f02efc4f90333790708097f4ad955beaaf41cdfe6ba11a5385a1ba8d5
2412e0910cc1deae89794bb142f6a0ec6089761fcace1f51f968b8f62bb19c32
34c4a7d2e16716cc0a9f9518718dd8efd2d36f97d2ee93721b9c2b40f4a164ce
cad6df3e9a9ac2d74b5c5276ab7192b8b876cde19259b8a567c80e44362e898f
f10a61792867b7b2d84daa851f8d24169a96cb70b55e09931a7ed2c01853634f
c3c235915752db934ca00b7c30cbcb2b5d83c2a52400ac29ccc1bd66573c534f
ad248905f0468cc57eacd8d3dadd474cd31a8b778c2a0eb952f48bdc525a1ee8
825caca7729cb19432c87c581b6a16240d21f1f3903b81cc98184bd80aa01de2
9ffbfc64827a32593bdcff306f45afaaa69cda089c1b3ed28a8889d17dbf33d0
76692d50ea8233a8ca9d3f9a89890d9a2149f0ff9859476920ed3ffc84c63f64
4caa9777053748e8ee0190b4056f93e1cc6506c212c06c67622c0cf6f476665b
a0cdffded083ccadb44b6b7841cd16580cf4638a573d2684134181dca7462d3a
6a11ab33aa16d2d8ba08cb3c6edb5e0613c1d459287261ecd907f9359068cbc8
b7fc85c1e68221a10c9c9cc8c321f1a2cce8be9914cf5033a382d6634dbb0aa6
affbb0db85505a477fad583411e0361f0502ef4d9c46059da31ca85eb0e0b5d6
261a6e855850526b2697a4065225fee9338f1e2c916f57e60e04516709069141
8c787bab18fce858e66ef04e233ec2e318503e250300628707bc833f23a79194
aa0227c6018d030ef8e31630cd92673ac3d30f7826a49059b4abfc26c77fd486
18af0ba21e4c33129d6a6774af76b2f09cf8ddf9e05fc9917c7b25a6e978e034
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8cbf5d97770d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8cbf5d97770dedc4bc8ca8cc5cd745900e0524d6d4ecb5db43de5efe87250b75

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:YahLover
Create hunting rule
Author:Kevin Falcoz
Description:YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/9698/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::CopySid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::GetAce
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
IPHLPAPI.DLL::IcmpCreateFile
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments