MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af3f5610187dd9fadeffd7148fce068c920c10a824bc7e139550e06dd4cca882. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af3f5610187dd9fadeffd7148fce068c920c10a824bc7e139550e06dd4cca882
SHA3-384 hash: 783b99e81f8fec4a7c19d24d2a0313f26cb292e44a141d393554d6faafcede4ad99349b6f8b54cdd5e9e5afc1a76e1b1
SHA1 hash: 0dc9f725e788e4f9fbe3ed3e5d5d843b19219add
MD5 hash: e23127608b4663dbf503382769f481ca
humanhash: mockingbird-cold-stairway-lion
File name:PO-000806758.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'207'296 bytes
First seen:2026-04-07 09:58:06 UTC
Last seen:2026-05-08 12:42:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 24576:jYH8+v9n1dE8ZlXmlFPVvbJV33Jqx/cxGIiw4:kZvLfZlWLPpbJVYx/cxa1
Threatray 2'680 similar samples on MalwareBazaar
TLSH T1DE45F1113A4FE691FCA84F701566F6394B223EE8B411D2059EE8BEE777F27923425702
TrID 44.6% (.EXE) Win64 Executable (generic) (6522/11/2)
14.0% (.ICL) Windows Icons Library (generic) (2059/9)
13.8% (.EXE) OS/2 Executable (generic) (2029/13)
13.7% (.EXE) Generic Win/DOS Executable (2002/3)
13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon b270f0f0f0f070b2 (2 x RemcosRAT, 2 x AsyncRAT, 1 x Formbook)
Reporter lowmal3
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
164
Origin country :
DE DE
Vendor Threat Intelligence
Gathering data
Malware family:
n/a
ID:
1
File name:
PO-000806758.exe
Verdict:
No threats detected
Analysis date:
2026-04-07 09:59:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/43f7af9d-83ff-43e6-b058-298bec378c23

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/60699/
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.61713569.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69d4d54366ab6d001dcfcf6d
Tags:
infosteal stration shell spawn
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Launching a process
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/af3f5610187dd9fadeffd7148fce068c920c10a824bc7e139550e06dd4cca882
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-04-06T22:45:00Z UTC
Last seen:
2026-04-09T06:16:00Z UTC
Hits:
~100
Detections:
VHO:Trojan.Win32.PowerShell.gen Trojan.Win32.Agent.sb PDM:Trojan.Win32.Generic HEUR:Backdoor.MSIL.Remcos.gen
Link:
https://opentip.kaspersky.com/af3f5610187dd9fadeffd7148fce068c920c10a824bc7e139550e06dd4cca882/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e081e127-a4cf-4a78-92a8-15e1c08018f4
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1894516
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Behaviour
Behavior Graph:
Download SVG
Score:
92%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/af3f5610187dd9fadeffd7148fce068c920c10a824bc7e139550e06dd4cca882
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af3f5610187dd9fadeffd7148fce068c920c10a824bc7e139550e06dd4cca882/
Verdict:
Malicious
Threat:
VHO:Trojan.Win32.PowerShell
Link:
https://tip.neiki.dev/file/af3f5610187dd9fadeffd7148fce068c920c10a824bc7e139550e06dd4cca882
Threat name:
ByteCode-MSIL.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-04-07 04:18:21 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
8
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v47vmeaypxm7vxx724ki7tqgrsjayefies6h4e4vkdqg3vgmvcba._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
4d2d2c6efbb042ae0af1b79c8cc52237998ec70df56afd418abbacc48d9d3395
Formbook
5c0bdefeb2e965c9cb1aa42e28b84b31e11693b4438c47e97be98fb1b496d940
Formbook
61faeb3857dc422b26292ff17b24a2ed3cb18415f8c0a6f64a707c51a0a9c147
Formbook
706bd04b5489a253c4e35239df8e08b74f873dbfe8e5dfb3cfdd4a43491f9c62
Formbook
759388bf61a6134039a3bc1577bf1650b2f0f7d65cd43c49b3b8010f642a67fd
Formbook
9029bab7100d209fa33c32f5450d0fc7a5661d4e481069aec127adc719f7308c
Formbook
cda6a5e6cfad4f58e6953bb9365b6044880899c6c0e079b1a68a4f193a2f1a16
Formbook
e4ff62b66b02a6f78870344b002d83ae80391d1cc0b1651085f23f28d41f027b
Formbook
error
Formbook
+ 2'670 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution
Link:
https://tria.ge/reports/260407-lzl6xsfx4z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Unpacked files
SH256 hash:
af3f5610187dd9fadeffd7148fce068c920c10a824bc7e139550e06dd4cca882
MD5 hash:
e23127608b4663dbf503382769f481ca
SHA1 hash:
0dc9f725e788e4f9fbe3ed3e5d5d843b19219add
Link:
https://www.unpac.me/results/1ae85dd8-a238-4654-8bca-c8825a99442b/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/af3f5610187d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/af3f5610187dd9fadeffd7148fce068c920c10a824bc7e139550e06dd4cca882

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Executable exe af3f5610187dd9fadeffd7148fce068c920c10a824bc7e139550e06dd4cca882

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/60699/

Comments