MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c17a3728cc73294f7391e0fc33d4ab7534a030911b517d01176c8f4dbd7d8628. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 18
| SHA256 hash: | c17a3728cc73294f7391e0fc33d4ab7534a030911b517d01176c8f4dbd7d8628 |
|---|---|
| SHA3-384 hash: | 1ec7c55fb32d34ebbf4d97aede48e90d92c98c2c213dc2dce96a0d9a96ac55a296886245aed046b1768e6ee4c2d95c44 |
| SHA1 hash: | 39851c73281c9038c95c7be8ac59f44cde14dd27 |
| MD5 hash: | de5967b735eb90f2303ddb509eff6da5 |
| humanhash: | louisiana-sink-alaska-sweet |
| File name: | c17a3728cc73294f7391e0fc33d4ab7534a030911b517d01176c8f4dbd7d8628 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 1'248'768 bytes |
| First seen: | 2025-10-09 15:08:37 UTC |
| Last seen: | 2025-11-06 10:01:55 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 1895460fffad9475fda0c84755ecfee1 (309 x Formbook, 52 x AgentTesla, 36 x SnakeKeylogger) |
| ssdeep | 24576:y5EmXFtKaL4/oFe5T9yyXYfP1ijXdaLY63nyrglkvkV0yIMWB+yNhByTu8q/:yPVt/LZeJbInQRaLpnFkcVDyNhcTu8 |
| Threatray | 2'403 similar samples on MalwareBazaar |
| TLSH | T1CD45BF027391C062FFAB92734B5AF6115BBC79260123A61F13981D7AFE701B1563E7A3 |
| TrID | 40.3% (.EXE) Win64 Executable (generic) (10522/11/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3) |
| Magika | pebin |
| Reporter |  adrian__luca |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
82
Origin country :
HUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Quotation RFQ.eml
Verdict:
Suspicious activity
Analysis date:
2025-09-29 10:32:19 UTC
Tags:
attachments attc-arch arch-exec
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Verdict:
Malicious
Score:
97.4%
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
adaptive-context autoit compiled-script explorer fingerprint keylogger lolbin microsoft_visual_cc obfuscated packed packed packer_detected threat
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-29T02:09:00Z UTC
Last seen:
2025-10-07T18:25:00Z UTC
Hits:
~100
Malware family:
Formbook
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
Malware
YARA:
7 match(es)
Tags:
AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86
Verdict:
Malicious
Threat:
Trojan.Win32.Inject
Threat name:
Win32.Trojan.AutoitInject
Status:
Malicious
First seen:
2025-09-29 07:58:20 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
21 of 24 (87.50%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 2'393 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
c17a3728cc73294f7391e0fc33d4ab7534a030911b517d01176c8f4dbd7d8628
MD5 hash:
de5967b735eb90f2303ddb509eff6da5
SHA1 hash:
39851c73281c9038c95c7be8ac59f44cde14dd27
SH256 hash:
05a88aac5cc146590581afc663e46f9920d6e40ce97e1d499da8c2900d36df65
MD5 hash:
d5c13600abc97d9052369c26094b810c
SHA1 hash:
2355fb56e9f3262a6d0d66c3635c6a92dcc6bb19
Detections:
win_formbook_g0
Parent samples :
c17a3728cc73294f7391e0fc33d4ab7534a030911b517d01176c8f4dbd7d8628
a684465a73338c71ef0b4094a7ea9cef4c7b75a9577286cbb9614bd6702a6917
032da2dc5566a0ea6335acb9a28dcd6d6083778614a8a7a2e0066a5baeeea2b5
19969e249cc3273a55861163c5a3390dc8a8d0466ee8b807549d238fb2a88122
a3c77fe08ffea584141564c36eb06d466c1f1babcc7cdac43cf2282bfcd02684
642a589dde40dbf7ea6506b6605b0eb9fe391f571923487f8bbf0d0d69c7aa0e
2779402264beca9b931165645a1661fd8f49ad5522b41046f4f6d9e502af6d47
44916f60e5ae854ee2a228103359191f51ccd738480d1302310e1561988e4217
a684465a73338c71ef0b4094a7ea9cef4c7b75a9577286cbb9614bd6702a6917
032da2dc5566a0ea6335acb9a28dcd6d6083778614a8a7a2e0066a5baeeea2b5
19969e249cc3273a55861163c5a3390dc8a8d0466ee8b807549d238fb2a88122
a3c77fe08ffea584141564c36eb06d466c1f1babcc7cdac43cf2282bfcd02684
642a589dde40dbf7ea6506b6605b0eb9fe391f571923487f8bbf0d0d69c7aa0e
2779402264beca9b931165645a1661fd8f49ad5522b41046f4f6d9e502af6d47
44916f60e5ae854ee2a228103359191f51ccd738480d1302310e1561988e4217
SH256 hash:
93435d035bba77a872a986a4a4c3b30a3b6e5ba10e90f254e5ac49ddc105c181
MD5 hash:
83e597674e1b09dfbb63c19f41af7a80
SHA1 hash:
05716631003b83d4069773ee78d56da5d609b8a4
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AutoIT_Compiled |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious. |
| Rule name: | CP_AllMal_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | pe_detect_tls_callbacks |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | TH_Generic_MassHunt_Win_Malware_2025_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Windows malware mass-hunt rule - 2025 |
| Reference: | https://cyfare.net/ |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.