MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b75db5d4979ec63cf001640529fd3be14433a40d03e17e751754909617ccc4af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 17

Intelligence 17 IOCs YARA 7 File information Comments

SHA256 hash:	b75db5d4979ec63cf001640529fd3be14433a40d03e17e751754909617ccc4af
SHA3-384 hash:	efe1f1970c5048b8707670134b3bcefb58aa67b46fe5f645b8fecd8d390cba28909100301d91593ccdd4eb2d8da918aa
SHA1 hash:	b3909e3b6190d60e6671f276001ae3c1fceb4479
MD5 hash:	f43c1433c85859e10ae548b22e4f4530
humanhash:	leopard-north-earth-william
File name:	87792.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'202'176 bytes
First seen:	2025-08-14 11:06:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep	24576:Ktb20pkaCqT5TBWgNQ7apLdg/I/Z0O8eOLm6A:3Vg5tQ7apRtKpeOa5
Threatray	2'720 similar samples on MalwareBazaar
TLSH	T15F45C01273DE8365C7725273BA25B701AEBF782506B1F96B2FD4093DF820122525EA73
TrID	40.3% (.EXE) Win64 Executable (generic) (10522/11/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter	adrian__luca
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

87792.exe

Verdict:

No threats detected

Analysis date:

2025-08-14 11:33:34 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e6b5b13c-77ba-4fa0-aec5-38d3082e6a74

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/21317/

Detection(s):

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689dc34c48c64d68735c5b37

Tags:

autoit emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Сreating synchronization primitives

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script fingerprint keylogger microsoft_visual_cc packed similar-threat

Link:

https://www.filescan.io/uploads/689dc356397fd3ce6fa921ef/reports/dfb0af4a-2fcb-4534-9e9b-e9d1ea1346fb/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/b75db5d4979ec63cf001640529fd3be14433a40d03e17e751754909617ccc4af

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/72d8074b-cb76-4b83-ae09-c8d97a25efa4

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/b75db5d4979ec63cf001640529fd3be14433a40d03e17e751754909617ccc4af

Verdict:

Malware

YARA:

7 match(es)

Tags:

AutoIt Decompiled Executable PDB Path PE (Portable Executable) Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/f43c1433c85859e10ae548b22e4f4530

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b75db5d4979ec63cf001640529fd3be14433a40d03e17e751754909617ccc4af/

Verdict:

Malicious

Threat:

Trojan.Win32.Strab

Link:

https://tip.neiki.dev/file/b75db5d4979ec63cf001640529fd3be14433a40d03e17e751754909617ccc4af

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-08-13 05:25:27 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 23 (86.96%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w5o3lvext3ddz4abmqcst7j34fcdhjanapqx45ixksijmf6mysxq._file

Verdict:

malicious

Label(s):

formbook

autoit

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan

Link:

https://tria.ge/reports/250814-m7rl2sttbv/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Formbook payload

Formbook

Formbook family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/3378c77b-e9a8-4a8b-bd1e-3bde4eaf4b0b

Unpacked files

SH256 hash:

b75db5d4979ec63cf001640529fd3be14433a40d03e17e751754909617ccc4af

MD5 hash:

f43c1433c85859e10ae548b22e4f4530

SHA1 hash:

b3909e3b6190d60e6671f276001ae3c1fceb4479

Link:

https://www.unpac.me/results/5e6964d7-2c59-4f24-a492-f244f4dfafa3/

SH256 hash:

01fb773a66a9719f00d87b750715ac26133135c2eca49f418ada90f623b091ac

MD5 hash:

f28aa4d5cb637d36a84ae42a4bd34573

SHA1 hash:

d758d6f97a3897f35762a4403663c8d80fec8286

Link:

https://www.unpac.me/results/5e6964d7-2c59-4f24-a492-f244f4dfafa3/

SH256 hash:

f6d64aae00d0850950f537b6f378f80c863e2428637e449fd3c07df8c8f693e2

MD5 hash:

cdbc87cf9cb8d2f131ea708fe1ee459b

SHA1 hash:

0a36a05ff1949fea03f08e911997ae06ab32252c

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/5e6964d7-2c59-4f24-a492-f244f4dfafa3/

Parent samples :

2bb632a09db119875479f7dd59ab37cecf387cc2257c7d0ad85a09e669a46463
8ded313c5dd477bf86f46ba6b7e48f886cb187ec2ffb5d748782092743d3796c
6ff7cf9f831b6458bbd03f0d03d1b55339024113f54722c0563f9180682c3e84
038296fb5ec73bfe8a3a99598049443a674240ee483ae7bc13e39c36ea61b5f1
b75db5d4979ec63cf001640529fd3be14433a40d03e17e751754909617ccc4af

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b75db5d4979e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b75db5d4979ec63cf001640529fd3be14433a40d03e17e751754909617ccc4af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	YahLover Create hunting rule
Author:	Kevin Falcoz
Description:	YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

exe b75db5d4979ec63cf001640529fd3be14433a40d03e17e751754909617ccc4af

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/21317/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample