MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e3448b29c55aa5f0fc081bfff05ed59ad5e7ed136161cf632d3ef43a4c4b553. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 19


Intelligence 19 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e3448b29c55aa5f0fc081bfff05ed59ad5e7ed136161cf632d3ef43a4c4b553
SHA3-384 hash: d83da93be4c0149994c6d948c123d03721e008449a5d34c839910aed342e3be1dbd3bb73abebb39b84579dd7a3e4c43b
SHA1 hash: 027b301e9356fc5b820edd43d469558b74d3b544
MD5 hash: 55c77b3807bc7ad34146698ebed07462
humanhash: juliet-salami-music-snake
File name:RFQ- PR Ref 34838 ITR6967.xlsx
Download: download sample
Signature Formbook
Create hunting rule
File size:1'550'053 bytes
First seen:2025-12-10 10:16:51 UTC
Last seen:Never
File type:Excel file xlsx
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep 24576:vBMlqgJ651uPU0LN1Y0fgjYv3cxqKNh9J41Zf+4swG5mIP9yJ1/3+LIrw5n0hBp8:vcR8CUGEab3cP39611+FP9yJUqIM8
TLSH T10175336D53914911FC9CD29C908E9C0A1CF1E86A4CF803A6535C898C8AEBDB73F5977B
TrID 61.2% (.XLSX) Excel Microsoft Office Open XML Format document (34000/1/7)
31.5% (.ZIP) Open Packaging Conventions container (17500/1/4)
7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika xlsx
Reporter cocaman
Tags:CVE-2017-11882 FormBook RFQ xlsx


Avatar
cocaman
Malicious email (T1566.001)
From: "Nicholas Jordan <nicholas@corrinerichards.info>" (likely spoofed)
Received: "from mail.corrinerichards.info (unknown [160.191.214.76]) "
Date: "Wed, 10 Dec 2025 09:21:01 +0100 (CET)"
Subject: "RFQ -|PR Ref: 34838| ITR6967"
Attachment: "RFQ- PR Ref 34838 ITR6967.xlsx"

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE dump

MalwareBazaar was able to identify 3 sections in this file using oledump:

Section IDSection sizeSection name
A11756172 bytesOle10nativE
A20 bytesx8K2gI0jgLvuYngamVhO8

Intelligence

File Origin
# of uploads :
1
# of downloads :
187
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
MSO
Details
MSO
extracted OLE packages, if they are present within the input OOXML document
Link:
https://research.acce.ciphertechsolutions.com/results/5947550e-6a76-40c7-b48e-b50fe75248ce/
Malware family:
n/a
ID:
1
File name:
RFQ- PR Ref 34838 ITR6967.xlsx
Verdict:
No threats detected
Analysis date:
2025-12-10 10:18:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0a1aba7f-91d0-40c0-ad40-a26c3e9a3fcf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/44136/
Detection(s):
SecuriteInfo.com.Malware.XML.Autoload-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Shelter.Malware.BadMacro.BadOleNatEquat.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EQAndMisCasedOleNativeWasTheCaseThatTheyGaveMe.20200215.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EQEditorFBShellzLetMeBlowYourMind.20210218.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=693948b3a675b653bd0faa63
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a window
Searching for synchronization primitives
Launching a process
DNS request
Sending an HTTP GET request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Сreating synchronization primitives
Launching a service
Changing a file
Reading critical registry keys
Connection attempt by exploiting the app vulnerability
Launching a file downloaded from the Internet
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a recently created process by asynchronous procedure call
Stealing user critical data
Creating a process from a recently created file
Unauthorized injection to a system process
Launching a process by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
OOXML Excel File with Embedding Objects
Link:
https://app.docguard.net/9e3448b29c55aa5f0fc081bfff05ed59ad5e7ed136161cf632d3ef43a4c4b553/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug autoit embedequation exploit fingerprint installer-heuristic keylogger packed shellcode
Link:
https://www.filescan.io/uploads/693948af1eac7b9b76a381b8/reports/51b0f436-9b8c-4aca-84ac-25224a0a8f75/overview
Verdict:
Malicious
Labled as:
Msoffice/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/9e3448b29c55aa5f0fc081bfff05ed59ad5e7ed136161cf632d3ef43a4c4b553
Label:
Malicious
Suspicious Score:
9.8/10
Score Malicious:
99%
Score Benign:
1%
Link:
https://www.malware.ai/gui/files/?id=772ddbdb-999d-4e63-8bab-ab1200ade6df
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/9e3448b29c55aa5f0fc081bfff05ed59ad5e7ed136161cf632d3ef43a4c4b553
Details
Document With No Content
Document contains little or no semantic information.
Verdict:
Malicious
File Type:
xlsx
First seen:
2025-12-10T06:30:00Z UTC
Last seen:
2025-12-10T23:00:00Z UTC
Hits:
~100
Detections:
Trojan-Spy.Noon.HTTP.ServerRequest Trojan-Dropper.Win32.Dorifel.sbd Trojan.Win32.Zenpak.sb PDM:Trojan.Win32.Generic Trojan.Win32.Auzenpak.sb Trojan.Win32.Agent.sb Trojan-Spy.Win32.Noon.sb Trojan.Win32.Shelma.sb Trojan.Win32.Inject.sb HEUR:Exploit.MSOffice.Generic Exploit.MSOffice.CVE-2018-0802.b Backdoor.Agent.HTTP.C&C Trojan.Win32.Strab.sb Exploit.MSOffice.CVE-2017-11882.sb Trojan-PSW.Win32.Stealer.sb Trojan-Downloader.MSOffice.SLoad.sb Trojan-Spy.Win32.Noon.bouh
Link:
https://opentip.kaspersky.com/9e3448b29c55aa5f0fc081bfff05ed59ad5e7ed136161cf632d3ef43a4c4b553/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1830118
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
OFFICE
Link:
https://malprob.io/report/9e3448b29c55aa5f0fc081bfff05ed59ad5e7ed136161cf632d3ef43a4c4b553
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Office Document
Link:
https://app.malva.re/file/55c77b3807bc7ad34146698ebed07462
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9e3448b29c55aa5f0fc081bfff05ed59ad5e7ed136161cf632d3ef43a4c4b553/
Verdict:
Malicious
Threat:
Trojan.Win32.Inject
Link:
https://tip.neiki.dev/file/9e3448b29c55aa5f0fc081bfff05ed59ad5e7ed136161cf632d3ef43a4c4b553
Threat name:
Document-Office.Exploit.CVE-2017-11882
Create hunting rule
Status:
Malicious
First seen:
2025-12-10 10:17:22 UTC
File Type:
Document
Extracted files:
16
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ty2ermu4kwvf6d6aqg776bpnlgwv47wrgylbz5rs2pxuhjgewvjq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
error
Formbook
Result
Malware family:
n/a
Score:
  1/10
Tags:
persistence ransomware
Link:
https://tria.ge/reports/251210-mbhz2aymet/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Verdict:
Suspicious
Tags:
exploit
YARA:
INDICATOR_OLE_EXPLOIT_CVE_2017_11882_1
Link:
https://app.threat.zone/submission/38b141ce-2bc1-43d2-88e1-c1e8b574535d
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9e3448b29c55/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9e3448b29c55aa5f0fc081bfff05ed59ad5e7ed136161cf632d3ef43a4c4b553

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Excel file xlsx 9e3448b29c55aa5f0fc081bfff05ed59ad5e7ed136161cf632d3ef43a4c4b553

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/44136/

Comments