MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a511d02211003769575ee9e8a44888c5e11263400a8188033f9892da1b6b6a0a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 16
| SHA256 hash: | a511d02211003769575ee9e8a44888c5e11263400a8188033f9892da1b6b6a0a |
|---|---|
| SHA3-384 hash: | 1bd0d117f50a0de291733b960a00ab201cf56ae944aadaad8968411ac0b0dbf9dee8f8c7050f7859aae248967c3ba904 |
| SHA1 hash: | 7d77f2a106b3229587143cc962eaa2f36b288f43 |
| MD5 hash: | c086246a14362e356f3413615b778079 |
| humanhash: | arkansas-oven-spaghetti-zulu |
| File name: | SPECIFICATIONS.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 1'444'864 bytes |
| First seen: | 2026-07-27 09:43:34 UTC |
| Last seen: | 2026-07-27 11:48:12 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'125 x AgentTesla, 20'143 x Formbook, 12'362 x SnakeKeylogger) |
| ssdeep | 24576:3oULR4THPSnhaN7LUNaQWfDlFFcMi7SxjTPgZzVj5CMqLF7PjE14Xkv:3oULRiH6gyopfDNcMi7cPyj5CPRjE14U |
| TLSH | T1EE65D02B2D13A536D7716EBF0C60E0B517686C56A5E4E1063EDEFDAB7C3AE013904352 |
| TrID | 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| dhash icon | f0cca6aaaaa6ccf0 (8 x Formbook, 6 x XWorm, 4 x AsyncRAT) |
| Reporter |  lowmal3 |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
3
# of downloads :
151
Origin country :
DEVendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-07-27 09:45:13 UTC
Tags:
auto-reg
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching a service
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
dropper packed
Verdict:
Malicious
Labled as:
Strictor.Generic
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-27T06:24:00Z UTC
Last seen:
2026-07-27T06:44:00Z UTC
Hits:
~10
Verdict:
Unknown
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
AI detected malicious Powershell script
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
Bypasses PowerShell execution policy
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Yara detected AntiVM3
Yara detected FormBook
Yara detected Powershell decode and execute
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.52 Win 32 Exe x86
Threat name:
Win32.Trojan.Strictor
Status:
Malicious
First seen:
2026-07-27 09:32:04 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
17 of 36 (47.22%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
Formbook
Similar samples:
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook adware collection discovery execution persistence rat spyware stealer trojan
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
a511d02211003769575ee9e8a44888c5e11263400a8188033f9892da1b6b6a0a
MD5 hash:
c086246a14362e356f3413615b778079
SHA1 hash:
7d77f2a106b3229587143cc962eaa2f36b288f43
SH256 hash:
6566e8308613e4bc420d39c5adb3195ac476be33333555e6bf428198d8b82df2
MD5 hash:
e92be0bb009c79f6bd194420f1fa219c
SHA1 hash:
85da628c84cf6a8324a48e84d91be1d37fceb93b
SH256 hash:
47a856ff7d9bf14949f9a1deed4ba4ec9495a9ef95ee41ba6d78f630561d166c
MD5 hash:
332b4cd85d1b878f5c5bf709b5984644
SHA1 hash:
ddba69ce01e7ea28029d271d4dd2f75bc3bf454f
SH256 hash:
04a6774ed1320e637d2d0da7e75ae766d8036d1b5a9c4ab89f0d4cf9ad17965f
MD5 hash:
2a4b82eb164d84f5373c2e397db4f934
SHA1 hash:
6cfd1773a29670dd4b71ce9961570a4ea1636ce7
Malware family:
FormBook
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| Rule name: | DebuggerCheck__GlobalFlags |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Active |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Thread |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| Rule name: | dgaagas |
|---|---|
| Author: | Harshit |
| Description: | Uses certutil.exe to download a file named test.txt |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | TH_Win_ETW_Bypass_2025_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Windows ETW Bypass Detection Rule - 2025 |
| Reference: | https://cyfare.net/ |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.