MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a148126bd00fc6170aefb6728c2792f592d94306efe6c21557132c71c668d6a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 16


Intelligence 16 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a148126bd00fc6170aefb6728c2792f592d94306efe6c21557132c71c668d6a1
SHA3-384 hash: 58473a4c77fe2c59dc309272fa5269fc0b7aab9749b04464f9e7a4e0aba1c2e2e3d2bf927dd1e1147ac04bfbe07547ef
SHA1 hash: 992089c83ed78634af60b97f41006f93618e73a6
MD5 hash: 19c0c0cb6b87dbd88d8e81fdfd622d39
humanhash: north-victor-spaghetti-saturn
File name:DHL - 1606560986.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:757'760 bytes
First seen:2025-08-06 20:51:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:fmNot5QSgIftJXQ/m/6gRt9oYMzK8MiUeJpreUEeNEjLdSt37/0DK:fmNot5PXf/rW2jiDprenwEfq70
Threatray 25 similar samples on MalwareBazaar
TLSH T18DF412083ABCCF35D6D953FA29B1E37003B52C7DE122D24A9FDAACCB34107A15A14792
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:DHL exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL - 1606560986.exe
Verdict:
No threats detected
Analysis date:
2025-08-06 21:46:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0061733e-e1b0-4933-8fc9-4704a7930296

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19374/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6893c09d1e8a59ee04e6b561
Tags:
stration shell spawn
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Adding an exclusion to Microsoft Defender
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/6893c090397fd3ce6f9fc290/reports/d459b845-cab2-43b0-9910-60ae2c661c79/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/a148126bd00fc6170aefb6728c2792f592d94306efe6c21557132c71c668d6a1
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5d2a7557-de3a-43fd-b535-7f418e7b2c19
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1751795
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1751795 Sample: DHL - 1606560986.exe Startdate: 06/08/2025 Architecture: WINDOWS Score: 100 35 www.teleexplore.xyz 2->35 39 Suricata IDS alerts for network traffic 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected FormBook 2->43 47 5 other signatures 2->47 10 DHL - 1606560986.exe 4 2->10         started        signatures3 45 Performs DNS queries to domains with low reputation 35->45 process4 file5 33 C:\Users\user\...\DHL - 1606560986.exe.log, ASCII 10->33 dropped 57 Adds a directory exclusion to Windows Defender 10->57 14 DHL - 1606560986.exe 10->14         started        17 powershell.exe 23 10->17         started        19 DHL - 1606560986.exe 10->19         started        signatures6 process7 signatures8 59 Maps a DLL or memory area into another process 14->59 21 VZqP68mcm3mN.exe 14->21 injected 61 Loading BitLocker PowerShell Module 17->61 23 conhost.exe 17->23         started        process9 process10 25 cacls.exe 13 21->25         started        signatures11 49 Tries to steal Mail credentials (via file / registry access) 25->49 51 Tries to harvest and steal browser information (history, passwords, etc) 25->51 53 Maps a DLL or memory area into another process 25->53 55 2 other signatures 25->55 28 Dn9gRKrfCd.exe 25->28 injected 31 chrome.exe 25->31         started        process12 dnsIp13 37 www.teleexplore.xyz 76.223.54.146, 49722, 80 AMAZON-02US United States 28->37
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a148126bd00fc6170aefb6728c2792f592d94306efe6c21557132c71c668d6a1
Verdict:
inconclusive
YARA:
7 match(es)
Tags:
.Net Executable PDB Path PE (Portable Executable) SOS: 0.35 Win 32 Exe x86
Link:
https://app.malva.re/file/19c0c0cb6b87dbd88d8e81fdfd622d39
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a148126bd00fc6170aefb6728c2792f592d94306efe6c21557132c71c668d6a1/
Threat name:
ByteCode-MSIL.Trojan.DarkCloud
Create hunting rule
Status:
Malicious
First seen:
2025-08-06 20:53:34 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ufebe26qb7dbocxpwzziyj4s6wjnsqyg57tmefkxcmwhdrti22qq._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
formbook
Create hunting rule
Similar samples:
00d6bcb13a0e5ee0a759c663a63d75866a7ceacbc91e3b63d96580926c5053af
Formbook
1583f581b4aed3b58c6dfaa9e8934acb0afbfe12ebc7a5c99ee8757242b4f7fa
Formbook
1bfc67fda739fb4b9d8ec51ab705c1348396d37eb76be0035183e12b26c7f6ea
Formbook
6bfefb0f3b8a878aec69c3d830824c3bf7d5181ffd6d6e88dc4a8d793370c233
Formbook
9cc3509d0971ef4d17669266b88c3e7c47e47581b277c5c8e4a59b93ef761c9b
Formbook
a148126bd00fc6170aefb6728c2792f592d94306efe6c21557132c71c668d6a1
Formbook
error
Formbook
+ 15 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/250806-zn3w7atscw/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3aaa3a5b-6d9a-4744-a634-919588a4b641
Unpacked files
SH256 hash:
a148126bd00fc6170aefb6728c2792f592d94306efe6c21557132c71c668d6a1
MD5 hash:
19c0c0cb6b87dbd88d8e81fdfd622d39
SHA1 hash:
992089c83ed78634af60b97f41006f93618e73a6
Link:
https://www.unpac.me/results/18e2d04c-6d61-4bfc-a317-badf4150bdaf/
SH256 hash:
6e5ae0f729a327bceefc2a7ada433ecb62251d3ffb41ea483dc7391e643dfd0f
MD5 hash:
9793092e9b13d76e3efe1fa1503759ef
SHA1 hash:
178c8b83c18aae0b3e1845c65b06d3dad71c310b
Link:
https://www.unpac.me/results/18e2d04c-6d61-4bfc-a317-badf4150bdaf/
SH256 hash:
9485dba36ff93583b154f4ab11730ed448f7ee199d2203e0166349e8a3640ef7
MD5 hash:
ccfd69f655d4d803882b790df1d2be62
SHA1 hash:
813de8f1af8fedc5fec1f608824b2d7fec05f830
Link:
https://www.unpac.me/results/18e2d04c-6d61-4bfc-a317-badf4150bdaf/
SH256 hash:
9eb341a6c9948b2c6f3ee3be9a29f2b76b0c60b73aed7c787ae10446502377d6
MD5 hash:
c8f723940a9bdebcdeeb1972e48eabc6
SHA1 hash:
9acc38f7c3c9fedb92c18b8f3fb13f0d5122b7ae
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/18e2d04c-6d61-4bfc-a317-badf4150bdaf/
Parent samples :
1583f581b4aed3b58c6dfaa9e8934acb0afbfe12ebc7a5c99ee8757242b4f7fa
a148126bd00fc6170aefb6728c2792f592d94306efe6c21557132c71c668d6a1
SH256 hash:
7fdb90f50f25a2ee61893a56a53cadba49274b71143bff854d40a104f53ea6e9
MD5 hash:
6a9e392389d0ad136892b19d8355c7ac
SHA1 hash:
3b9a9bee21adb3f0dc2caa82cf048589b0848639
Link:
https://www.unpac.me/results/18e2d04c-6d61-4bfc-a317-badf4150bdaf/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a148126bd00f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/19374/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments