MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cacb835e5321f503084fcb8ee3cc798936c5f32e4a1da58f58051dbe8ae8a843. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 4

Intelligence 4 IOCs YARA 10 File information Comments

SHA256 hash:	cacb835e5321f503084fcb8ee3cc798936c5f32e4a1da58f58051dbe8ae8a843
SHA3-384 hash:	74ec367e76129a31ef52058ecd2be601f19d5c562fc9de0b62349e7f3e72bc2766fa6f2cbb4d1a56946a322c25c96360
SHA1 hash:	8de1060127d7528bc673c3f37dd7c8c1ae78dd24
MD5 hash:	5deb226c0021f27951cc21cd33a8c4da
humanhash:	hamper-texas-georgia-lemon
File name:	SAFA AL REEM CONTRACTING LLC_pdf.rar
Download:	download sample
Signature	Formbook Create hunting rule
File size:	684'492 bytes
First seen:	2025-06-16 11:34:36 UTC
Last seen:	2025-06-16 13:48:02 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:irfnVSqnA/6tgjACZ/1IKiAU7Edoy9xig6Z/t0zriwc2totZS2QWY9FiC:6vVS5CtkAiqKRJ9xige/uI2totZ+9l
TLSH	T1B3E423D7A07941A02B1C2B4987124A6430697E2FDCFB6B3DE22E25DD0EC27F6D514E93
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	FormBook rar

cocaman

Malicious email (T1566.001)
From: "Al Reem Contracting <admin@natcdn.top>" (likely spoofed)
Received: "from mail.bestsmtp.top (unknown [161.248.179.26]) "
Date: "Mon, 16 Jun 2025 12:35:17 +0100"
Subject: "Fwd : SAFA AL REEM CONTRACTING LLC /Polyfabonline /Hurnergulf"
Attachment: "SAFA AL REEM CONTRACTING LLC_pdf.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	SAFA AL REEM CONTRACTING LLC_pdf.exe
File size:	768'000 bytes
SHA256 hash:	d6a676ac2fedead7999ed8250543e38da6096cc6efd3c7517d49d6b090ffbec2
MD5 hash:	87d1288415a11be056d3354ef149bc59
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685001818bd5d68a12e8cd54

Tags:

n/a

Gathering data

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/cacb835e5321f503084fcb8ee3cc798936c5f32e4a1da58f58051dbe8ae8a843

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cacb835e5321f503084fcb8ee3cc798936c5f32e4a1da58f58051dbe8ae8a843/

Threat name:

ByteCode-MSIL.Trojan.ZmutzyPong

Status:

Malicious

First seen:

2025-06-16 11:34:40 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

16 of 23 (69.57%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zlfygxsteh2qgccpzohohtdzre3ml4zojio2ld2yauo35cxivbbq._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/250616-pkq34sbr9y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/cacb835e5321f503084fcb8ee3cc798936c5f32e4a1da58f58051dbe8ae8a843

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)