MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3f13102022fc7a6444117df441bbd4c7288e191f38c10adbef60cc270905a4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c3f13102022fc7a6444117df441bbd4c7288e191f38c10adbef60cc270905a4f
SHA3-384 hash:	958d9013dcae0aa9daa0aa61a44f9ab24dfc61fe695a4bc576e3bbb42d104818bac43f82cdb9b0f548467970d6cd657d
SHA1 hash:	80284c4037008e79d0f6250e25346d17c9479f91
MD5 hash:	fa6618d283a0d6482c7e238caf915aed
humanhash:	fourteen-india-fix-kitten
File name:	UCHI.ps1
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	861'856 bytes
First seen:	2025-04-03 06:55:10 UTC
Last seen:	2025-04-11 04:16:50 UTC
File type:	ps1
MIME type:	text/plain
ssdeep	12288:m5xrKP5KleEgMVIRuIe2vjRYPq6TpjfyFJcBpCSBBh/CqU5t5lLW7jMDOxkec7Wp:m5xC52HMezPqef2vAKqo5w7A6y+
TLSH	T1BB05021085C42FB9CFAC591CD0FE260E93F04E8A556AB58AEF737D4AAFEB504411B1D8
Magika	powershell
Reporter	abuse_ch
Tags:	176-65-142-190 FormBook ps1

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

196

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.Trojan.Agent.NOTQQP.5639.24554.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ee3385cfd0a37f830cf799

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

confuserex dropper obfuscated packed packed

Link:

https://www.filescan.io/uploads/67ee30e52d430c849e043136/reports/4f4bc64a-b467-4a3b-852d-186589941c07/overview

Hybrid Analysis PowerShell_TrojanDropper_Agent_AQD

Verdict:

Malicious

Labled as:

PowerShell_TrojanDropper_Agent_AQD

Link:

https://www.hybrid-analysis.com/sample/c3f13102022fc7a6444117df441bbd4c7288e191f38c10adbef60cc270905a4f

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1655326

Signature

Allocates memory in foreign processes

Antivirus detection for dropped file

Contains functionality to inject code into remote processes

Found direct / indirect Syscall (likely to bypass EDR)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

PE file has nameless sections

Performs DNS queries to domains with low reputation

Powershell drops PE file

Queues an APC in another process (thread injection)

Suricata IDS alerts for network traffic

Suspicious execution chain found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected FormBook

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c3f13102022fc7a6444117df441bbd4c7288e191f38c10adbef60cc270905a4f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c3f13102022fc7a6444117df441bbd4c7288e191f38c10adbef60cc270905a4f/

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.Heuristic

Threat name:

Script-PowerShell.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-02 08:51:10 UTC

File Type:

Text (PowerShell)

AV detection:

7 of 36 (19.44%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ypytcaqcf7d2mrcbc7puig55jrzirymr6ogbbln66ygme4eqljhq._file

Threatray formbook

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

Similar samples:

error

Formbook

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery execution

Link:

https://tria.ge/reports/250403-hp2bba1ygz/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Formbook

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c3f13102022fc7a6444117df441bbd4c7288e191f38c10adbef60cc270905a4f