MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 cb9b29844f69bbb116dca8b6cf826cfa67a37a26026dab16d97360a1f0cce729. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 8
| SHA256 hash: | cb9b29844f69bbb116dca8b6cf826cfa67a37a26026dab16d97360a1f0cce729 |
|---|---|
| SHA3-384 hash: | cdfc5ab054899f5aa77542c6625454e1765774cde51e0d798e0a900b851d1622c1ada7f1a103cf1828f05c290ae35929 |
| SHA1 hash: | 67d404754b67977687317b624e1546d5f516623f |
| MD5 hash: | 6a9f7f3048336a2a808e8cc071bb99ff |
| humanhash: | speaker-avocado-florida-network |
| File name: | Order Specifications 10-12-25.rar |
| Download: | download sample |
| Signature | Formbook |
| File size: | 517'327 bytes |
| First seen: | 2025-12-10 08:49:24 UTC |
| Last seen: | Never |
| File type: | rar |
| MIME type: | application/x-rar |
| ssdeep | 12288:xeJeIe+d6BSI/RauOoXXk1Qs00YmqB6ctbmmoSwOJiPmOxO7p4Q8EaB:gw1DfXKdYmG6AwWaOtKEaB |
| TLSH | T180B4236677C05167CB8DB64EA0807E01964039E6F2C985DEE5B92176CFBBFA43D1CE40 |
| TrID | 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1) |
| Magika | rar |
| Reporter |  cocaman |
| Tags: | FormBook rar |
cocaman
Malicious email (T1566.001)From: "Mustaqim Musa<info@thernastersteel.com>" (likely spoofed)
Received: "from server.thernastersteel.com (server.thernastersteel.com [45.90.98.32]) "
Date: "9 Dec 2025 23:20:45 -0800"
Subject: "=?UTF-8?B?Rlc6IElucXVpcnkg4oCTIEJPUSBBdHRhY2hlZA==?="
Attachment: "Order Specifications 10-12-25.rar"
Intelligence
File Origin
# of uploads :
1
# of downloads :
77
Origin country :
CHFile Archive Information
This file archive contains 1 file(s), sorted by their relevance:
| File name: | Order Specifications 10-12-25.vbe |
|---|---|
| File size: | 2'112'464 bytes |
| SHA256 hash: | 0ac74eafee626ebec80376eb13837525572a52e04cd595ba1a501dca0606cb8d |
| MD5 hash: | af652825a2501a10d3a531655368d480 |
| MIME type: | application/octet-stream |
| Signature | Formbook |
Vendor Threat Intelligence
Detection(s):
Verdict:
Clean
Score:
70%
Tags:
n/a
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
anti-vm
Verdict:
Malicious
File Type:
rar
First seen:
2025-12-10T08:49:00Z UTC
Last seen:
2025-12-11T05:23:00Z UTC
Hits:
~10
Verdict:
Malware
YARA:
1 match(es)
Tags:
DeObfuscated Obfuscated Rar Archive T1059.005 VBScript
Threat name:
Win32.Trojan.Vigorf
Status:
Malicious
First seen:
2025-12-10 08:50:31 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
8 of 24 (33.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook execution persistence rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Formbook
rar cb9b29844f69bbb116dca8b6cf826cfa67a37a26026dab16d97360a1f0cce729
(this sample)
vbe Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.