MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a62e87cd34cf7d2a62da54f2f75c9b5833960f14e0831831d01fb2fa53293c5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 12
| SHA256 hash: | a62e87cd34cf7d2a62da54f2f75c9b5833960f14e0831831d01fb2fa53293c5b |
|---|---|
| SHA3-384 hash: | 3fc773f82dcb53724d78e7d3e59409c0bef8549a991a8fa0c25b50febd93829bd1c6896df41c4dffbd82966004644f29 |
| SHA1 hash: | dc3d4373652a7493092e11468d7bdfbf5482dacf |
| MD5 hash: | 087963d1a513e676ea77d5c6947b25b6 |
| humanhash: | jupiter-lamp-white-nevada |
| File name: | a62e87cd34cf7d2a62da54f2f75c9b5833960f14e0831831d01fb2fa53293c5b |
| Download: | download sample |
| Signature | Formbook |
| File size: | 1'085'952 bytes |
| First seen: | 2026-08-10 14:34:28 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'190 x AgentTesla, 20'337 x Formbook, 12'364 x SnakeKeylogger) |
| ssdeep | 24576:Lj/Og3+6nIIhdtFQhUHBH+j15ElYHsk7ZJmG9Ae5ByJgqn:fPO6IKJPBblYMamgAejyJf |
| TLSH | T11C351224A6BBDD01D2798B71C8F2D0B003B06E4DE922C24B9ED97DD73A717861AC5763 |
| TrID | 72.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.4% (.EXE) Win64 Executable (generic) (6522/11/2) 4.4% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Magika | pebin |
| dhash icon | 3e73715d4d5d7d23 (62 x Formbook) |
| Reporter |  adrian__luca |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
54
Origin country :
HUVendor Threat Intelligence
Malware configuration found for:
NETReactor
RoboSki
Details
Gathering data
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
base64 entropy formbook net_reactor obfuscated packed packed
Verdict:
Malicious
Labled as:
FormBook.Generic
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-20T06:50:00Z UTC
Last seen:
2026-08-10T07:03:00Z UTC
Hits:
~1000
Gathering data
Score:
100%
Verdict:
Malware
File Type:
PE
Gathering data
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Status:
Malicious
First seen:
2026-07-20 09:44:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
22 of 36 (61.11%)
Threat level:
5/5
Verdict:
malicious
Label(s):
Formbook
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
a62e87cd34cf7d2a62da54f2f75c9b5833960f14e0831831d01fb2fa53293c5b
MD5 hash:
087963d1a513e676ea77d5c6947b25b6
SHA1 hash:
dc3d4373652a7493092e11468d7bdfbf5482dacf
SH256 hash:
9a97ba137c69d006ead3a771ea37494387212e13def8e57bd59a7a041b57bf0e
MD5 hash:
d5e9da32015e99436454e163597f3e3f
SHA1 hash:
0129fcbf0c673b9c7b1fe59436ef85bbccdbc244
SH256 hash:
3c915a42fd91c84c1c7d621de356c2fef30f421d253bd9e3997c98122308bebb
MD5 hash:
d67aefff579920c363377f14d36ee5bf
SHA1 hash:
8c7326fac869f8279b02d0e73ce1acbdc8ccffdc
SH256 hash:
187bb41803a5c8995c6f087503800f1d2aa070244a338623def3435385d45671
MD5 hash:
8ce31c28d6d82c0036ca5027ae15cb70
SHA1 hash:
be8f74dada183488ab8a47839aabd175c32e95f9
Malware family:
FormBook
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.