MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 911ab907376843edb05b47e615e37582276cc4af2b676727af7d61831d9fd044. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 19
| SHA256 hash: | 911ab907376843edb05b47e615e37582276cc4af2b676727af7d61831d9fd044 |
|---|---|
| SHA3-384 hash: | 00404b45bdd04ba5aa6b1058b01adb18066cb5f2df1bfc1c5a7cce1b525d3671a6824b4580779a6a2ee327b58adcc6ca |
| SHA1 hash: | c952a9c3bd78641b3118c633837a3028730a6566 |
| MD5 hash: | 22f951c3f6fabe1c08e8c906dda9699f |
| humanhash: | shade-football-connecticut-chicken |
| File name: | SecuriteInfo.com.Win32.Malware-gen.31592574 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 737'792 bytes |
| First seen: | 2025-11-04 02:28:38 UTC |
| Last seen: | 2025-11-04 11:52:06 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 21371b611d91188d602926b15db6bd48 (70 x Formbook, 33 x AgentTesla, 20 x RemcosRAT) |
| ssdeep | 12288:Kz7hU5I5yuNHIgzSFKxWltRohBfSTso93U/azayibDBNaezoyZwGK9GD+pxkhw:Kf+iN57Gtene3wSih0ezoz4w |
| Threatray | 2'061 similar samples on MalwareBazaar |
| TLSH | T1E8F422851A81A961E200A3308833CC5599783D606F06D73A872CFE7FBC75397E96775E |
| TrID | 39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6) 38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 7.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.9% (.EXE) OS/2 Executable (generic) (2029/13) |
| Magika | pebin |
| Reporter |  SecuriteInfoCom |
| Tags: | exe FormBook UPX |
UPX packed
This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.
| File size (compressed) : | 737'792 bytes |
|---|---|
| File size (de-compressed) : | 1'244'160 bytes |
| Format: | win32/pe |
| Unpacked file: | 480eba71b028d39614cfb7d3f83e75358348d256f8d27e687a4a85ba7499a1a4 |
Intelligence
File Origin
# of uploads :
5
# of downloads :
118
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.Malware-gen.31592574
Verdict:
No threats detected
Analysis date:
2025-11-04 02:30:50 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Verdict:
Malicious
Score:
96.5%
Tags:
autoit virus spawn
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
autoit compiled-script formbook microsoft_visual_cc packed packed packed unsafe upx virus
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-03T20:53:00Z UTC
Last seen:
2025-11-06T00:25:00Z UTC
Hits:
~1000
Detections:
Trojan-Spy.Noon.HTTP.ServerRequest Trojan-Dropper.Win32.Dorifel.sbd Trojan.Win32.Zenpak.sb PDM:Trojan.Win32.Generic Backdoor.Agent.HTTP.C&C Trojan-Spy.Win32.Noon.sb Trojan.Win32.Inject.sb Trojan-Spy.Win32.Noon.bnjr Trojan.Win32.Agent.sb Trojan-PSW.Win32.Stealer.sb Trojan.Win32.Strab.sb VHO:Trojan-Spy.Win32.Noon.bnjs
Malware family:
Formbook
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
Malware
YARA:
5 match(es)
Tags:
AutoIt Decompiled Executable PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86
Verdict:
Malicious
Threat:
Family.FORMBOOK
Threat name:
Win32.Trojan.AutoitInject
Status:
Malicious
First seen:
2025-11-04 02:31:47 UTC
File Type:
PE (Exe)
Extracted files:
52
AV detection:
27 of 38 (71.05%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'051 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook discovery rat spyware stealer trojan upx
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Formbook payload
Formbook
Formbook family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
911ab907376843edb05b47e615e37582276cc4af2b676727af7d61831d9fd044
MD5 hash:
22f951c3f6fabe1c08e8c906dda9699f
SHA1 hash:
c952a9c3bd78641b3118c633837a3028730a6566
SH256 hash:
480eba71b028d39614cfb7d3f83e75358348d256f8d27e687a4a85ba7499a1a4
MD5 hash:
d9f03f7ae6ead75190b91448bc0d7e27
SHA1 hash:
f473f27ed0365dbb4c43c624be4c264d62702a87
Detections:
AutoIT_Compiled
SH256 hash:
7bc02e40d267f0806ccbe4ddf692cf7e30e15aea70d7459a62be513ef77c43fa
MD5 hash:
64bb70052b94833bae8c6c2ed8355480
SHA1 hash:
3c5b9df2ff518b5026fa23510781e3d1cd15cd5a
SH256 hash:
4d0a2ce8f92ff91418249e57777e408c8129b090965f10baef979494f0793572
MD5 hash:
416dbb334ecbc16a85b532066f12240d
SHA1 hash:
8f34f4e13c28732bbc279ee38f5ea4e5d68540df
Malware family:
FormBook
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| Rule name: | DebuggerCheck__GlobalFlags |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Active |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Thread |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| Rule name: | dgaagas |
|---|---|
| Author: | Harshit |
| Description: | Uses certutil.exe to download a file named test.txt |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | pe_detect_tls_callbacks |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | TH_Win_ETW_Bypass_2025_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Windows ETW Bypass Detection Rule - 2025 |
| Reference: | https://cyfare.net/ |
| Rule name: | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser |
|---|---|
| Author: | malware-lu |
| Rule name: | upx_largefile |
|---|---|
| Author: | k3nr9 |
| Rule name: | win_upx_packed |
|---|---|
| Author: | Reedus0 |
| Description: | Rule for detecting UPX packed malware |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.