MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ddf7f818b62b95ca4b60a5177dfe46d00684f3f2b14998b8419f29e081186e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ddf7f818b62b95ca4b60a5177dfe46d00684f3f2b14998b8419f29e081186e7
SHA3-384 hash: 5ba4135762cbb9e973d61f983f52e2ac91ec7081d9eafd136e11bcb9111ad07be12c5e66b2116e4ff2e9c8b438daf37c
SHA1 hash: e159b79e4be1d90105adf342f794c93d80dec914
MD5 hash: 5bb45171d0f8c97ff6951d2f756115eb
humanhash: nuts-item-double-michigan
File name:MACHINE QUOTATION#005464511MN.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:811'008 bytes
First seen:2025-10-21 06:26:15 UTC
Last seen:2025-10-21 06:28:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:vBBf7GLK8w2OKwH4OBYOiRtaOP9HZGJ8twqMQGcwLofZsF7M6OW0B:vvf7H8gBYOizRP9HoitJM/c6oBsdXJ
Threatray 2'112 similar samples on MalwareBazaar
TLSH T1550512583B9BDD12EAD157B509A0E3B103348E59E510D2078FFAADDBF429F66781C2C2
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
101
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
MACHINEQUOTATION005464511MN.exe
Verdict:
No threats detected
Analysis date:
2025-10-21 06:39:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/020019c2-e8e9-4b2a-a266-c8ca615e7e0e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/33598/
Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68f7279e3edd081eba404743
Tags:
virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/68f727a9fd2d7e012f4bc042/reports/9c8528c1-0b74-4622-a921-12b7f9144974/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/8ddf7f818b62b95ca4b60a5177dfe46d00684f3f2b14998b8419f29e081186e7
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-21T01:03:00Z UTC
Last seen:
2025-10-23T04:05:00Z UTC
Hits:
~1000
Detections:
Trojan-Spy.Noon.HTTP.ServerRequest HEUR:Trojan-Spy.MSIL.Noon.gen VHO:Trojan-PSW.Win32.Convagent.gen Trojan-PSW.Win32.Stealer.sb PDM:Trojan.Win32.Generic Trojan-Spy.Win32.Noon.sb Trojan.MSIL.Taskun.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb
Link:
https://opentip.kaspersky.com/8ddf7f818b62b95ca4b60a5177dfe46d00684f3f2b14998b8419f29e081186e7/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1b065f17-4696-4bdd-a50b-875f26d82954
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1798924
Signature
.NET source code contains potential unpacker
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1798924 Sample: MACHINE QUOTATION#005464511MN.exe Startdate: 21/10/2025 Architecture: WINDOWS Score: 100 33 www.alientechnologies.xyz 2->33 35 www.kaivo.life 2->35 37 8 other IPs or domains 2->37 39 Suricata IDS alerts for network traffic 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected FormBook 2->43 47 4 other signatures 2->47 10 MACHINE QUOTATION#005464511MN.exe 3 2->10         started        signatures3 45 Performs DNS queries to domains with low reputation 33->45 process4 file5 25 C:\...\MACHINE QUOTATION#005464511MN.exe.log, ASCII 10->25 dropped 57 Injects a PE file into a foreign processes 10->57 14 MACHINE QUOTATION#005464511MN.exe 10->14         started        signatures6 process7 signatures8 59 Maps a DLL or memory area into another process 14->59 17 Wmf7TXVLQqj9M.exe 14->17 injected process9 dnsIp10 27 www.kaivo.life 203.161.57.148, 49691, 49692, 49693 VNPT-AS-VNVNPTCorpVN Malaysia 17->27 29 www.alientechnologies.xyz 13.248.169.48, 49700, 49701, 49702 AMAZON-02US United States 17->29 31 3 other IPs or domains 17->31 20 tasklist.exe 13 17->20         started        process11 signatures12 49 Tries to steal Mail credentials (via file / registry access) 20->49 51 Tries to harvest and steal browser information (history, passwords, etc) 20->51 53 Modifies the context of a thread in another process (thread injection) 20->53 55 2 other signatures 20->55 23 firefox.exe 20->23         started        process13
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8ddf7f818b62b95ca4b60a5177dfe46d00684f3f2b14998b8419f29e081186e7
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.16 Win 32 Exe x86
Link:
https://app.malva.re/file/5bb45171d0f8c97ff6951d2f756115eb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ddf7f818b62b95ca4b60a5177dfe46d00684f3f2b14998b8419f29e081186e7/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/8ddf7f818b62b95ca4b60a5177dfe46d00684f3f2b14998b8419f29e081186e7
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-10-21 05:13:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rxpx7amlmk4vzjfwbjixpx7enuagqtz7fmkjtc4edhzj4carq3tq._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
formbook
Create hunting rule
Similar samples:
29688877a36107747d055f72f6760d360a6f3715ef32d90f46815838b56e18dc
Formbook
542cc164aa04d17dcb1abc62c982d85db3774587b08af2c13e97aba02d164562
Formbook
69ae2e849e4b148f879630ae9e3a4f991602cc6a658dd732dd775c31839d69ce
Formbook
851086a8243f434fc01667d5985ce91d650d33929180dfd568d1ccc7bbcda5b1
Formbook
8c0cd5bdae1355f8bc7f7af9102fb77eb8b52e432cdbe17c27456be4af1082ab
Formbook
a4e1ceb8458e0bca4119adb33ded5b1ef154f0ba69594b2079fbbcfb48cbe4ce
Formbook
ad0a87e7d15323230f7732b7d734abe976d5e6b4e32ec086e7892ca0f67acfe7
Formbook
error
Formbook
f9926b77fd47dffc66e6f22e4ecd4d0f1b1b3e4b768064bb22b64be3094569f6
Formbook
+ 2'102 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/251021-g7f8esfw9c/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Unpacked files
SH256 hash:
37b8ef05c3896c962375e7c723550a8dba8eb8e62f289530921964b7268a5669
MD5 hash:
68931149e5fb89d02bb3c5b22a688950
SHA1 hash:
3a8c8d334e20aa89fb0d8a4c727a8ca2cdc43663
Link:
https://www.unpac.me/results/b0e50451-32e4-4ecc-a7ad-117cd3c1b760/
SH256 hash:
2b5ce314bbfe82bef11759c2bd18c0d57027e408fe4d30d194d4de27a4f02fcd
MD5 hash:
bcf4b81be6f3fb3065d28a4d1622f6a8
SHA1 hash:
4b149757f1a67c4dad1bea3af43bfb92a829ed04
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/b0e50451-32e4-4ecc-a7ad-117cd3c1b760/
SH256 hash:
c0418cf8a7952e204acfc87dc155fcceb5a486ead59260f2303dba78db496a31
MD5 hash:
bc82a9e341e9ede14ac25f6a8aa82e56
SHA1 hash:
63020718b421fbb439f2600961ede97d704130ee
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/b0e50451-32e4-4ecc-a7ad-117cd3c1b760/
Parent samples :
89c911723b05c5bce8bcd4dd0ec42f190763afc166e85e0fde944e2e752223c8
f9926b77fd47dffc66e6f22e4ecd4d0f1b1b3e4b768064bb22b64be3094569f6
8277de2a08c7a135350fa8498699a86bfd28ebf31402908dc523b2eef07084fd
bdb77fb15a71d15824003e2baca520124dab19ec99a1cd90e12769be216e1541
d9be66d734fe5c34f17805e4c54fc22862108dc83120fd30ea27679a0b32b442
8ddf7f818b62b95ca4b60a5177dfe46d00684f3f2b14998b8419f29e081186e7
e80ff6956ffb3e3189596fe42c13b03efb70c023bb9db2f83db9d91ec04a157c
f49d6efeab5a163ccaff6d8166c0be80e8430d50b4ba7c43df903dbb05bb7bfa
d87de6be63c49499dfe482bfdafbdca13760efb66c2d8af6950919f01f52608c
2c2b051b1f3085754054173c5afc5675b0bd9f2940f7ac81714f8b2d08faa63b
2acbd38d75a998bc663dc7f1ba6ccccf87d9724557b52b2966250cba1c70286b
dbecf6e2bad4b37d6d724a33c84bd1826dbd4f6eb0c490ef152b261c67edc751
ef191e2d10681d7e07d403c5a0f5c595fb55c54c9a66ddd6cabdb7af0d6f65b2
83ac2145013dfaebbf27d69340996ccc9ccbd9e609dce2b7be58c10f32b29a9b
SH256 hash:
132938c4c5bbe84b56bbc3dce6fa396334e0987f0f2bafeb3b8c7086f3003058
MD5 hash:
8766488f48f84ec68d0550c3e7b99089
SHA1 hash:
d13c56c61098e81829a6577293c8bc4afeece4b0
Link:
https://www.unpac.me/results/b0e50451-32e4-4ecc-a7ad-117cd3c1b760/
SH256 hash:
30689154f50349c60ea9abad2516b028118d792ce6872249c1bdc7e6dc4041a5
MD5 hash:
9442ea5f23d4cf92d27368d306844346
SHA1 hash:
b2c2a4be1e2787d3944ccddac1350cbff9954e54
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/b0e50451-32e4-4ecc-a7ad-117cd3c1b760/
Parent samples :
ccd4128457e3a74611a17bf4d5002f725d6ea59aceb4374b2851d9c38c2ebdc8
8ddf7f818b62b95ca4b60a5177dfe46d00684f3f2b14998b8419f29e081186e7
SH256 hash:
8ddf7f818b62b95ca4b60a5177dfe46d00684f3f2b14998b8419f29e081186e7
MD5 hash:
5bb45171d0f8c97ff6951d2f756115eb
SHA1 hash:
e159b79e4be1d90105adf342f794c93d80dec914
Link:
https://www.unpac.me/results/b0e50451-32e4-4ecc-a7ad-117cd3c1b760/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/8ddf7f818b62b95ca4b60a5177dfe46d00684f3f2b14998b8419f29e081186e7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe 8ddf7f818b62b95ca4b60a5177dfe46d00684f3f2b14998b8419f29e081186e7

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/33598/

Comments