MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc3ca5fb64666cfb1860c997333b0cc43f10fcc71a4a4840e47815fd659b907d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 17

Intelligence 17 IOCs YARA 9 File information Comments

SHA256 hash:	cc3ca5fb64666cfb1860c997333b0cc43f10fcc71a4a4840e47815fd659b907d
SHA3-384 hash:	fe27448831265af26cd3898856546584d6b161767512855e3b0e73e3bd8292771faee92a88713371deeca9b092d55a9c
SHA1 hash:	e64928277c79eebec35154d541e152d9513600ab
MD5 hash:	5621b94ee22762740d162c91ea1991f4
humanhash:	eight-undress-four-island
File name:	49b7629b41572ef6c7f0f8666d45ded1e2d18609782c3592443786073559fd4f
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'178'624 bytes
First seen:	2025-12-08 14:49:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0f7552f9514e3a32a8dc8a5a9d9c89a7 (12 x Formbook, 2 x SnakeKeylogger, 1 x a310Logger)
ssdeep	24576:Qtb20pkaCqT5TBWgNjVYFmfJvBJp1xiV6A:ZVg5tjVYF+JvBbu5
Threatray	2'744 similar samples on MalwareBazaar
TLSH	T1C345CF2273DE8361C7726273BA56B701AEBF7C2506B5F46B2FD4093DE820162521E673
TrID	50.4% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 19.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.5% (.EXE) Win32 Executable (generic) (4504/4/1) 3.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	abuse_ch
Tags:	exe FormBook upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 49b7629b41572ef6c7f0f8666d45ded1e2d18609782c3592443786073559fd4f

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	693'248 bytes
File size (de-compressed) :	1'178'624 bytes
Format:	win32/pe
Packed file:	49b7629b41572ef6c7f0f8666d45ded1e2d18609782c3592443786073559fd4f

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

AutoIt

Details

AutoIt

extracted scripts and files

Link:

https://research.acce.ciphertechsolutions.com/results/cf8e08f7-9d53-42a0-9714-f8a1ca4d9037/

Malware family:

n/a

ID:

File name:

49b7629b41572ef6c7f0f8666d45ded1e2d18609782c3592443786073559fd4f

Verdict:

No threats detected

Analysis date:

2025-12-08 18:20:39 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f8269eb9-f5cd-431d-9a79-716df18d61f9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/43195/

Detection(s):

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL

PUA.Win.Packer.Embedpe-3

PUA.Win.Packer.AcprotectUltraprotect-1

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6936e5e8881313558a2b87c2

Tags:

nymeria autoit emotet

Verdict:

Malicious

Labled as:

AIT:Trojan.Nymeria

Link:

https://www.hybrid-analysis.com/sample/cc3ca5fb64666cfb1860c997333b0cc43f10fcc71a4a4840e47815fd659b907d

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-12-08T13:16:00Z UTC

Last seen:

2025-12-09T19:12:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/cc3ca5fb64666cfb1860c997333b0cc43f10fcc71a4a4840e47815fd659b907d/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/8ef6dd64-f2e4-4baa-b488-5e109c34c93a

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1828869

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Binary is likely a compiled AutoIt script file

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Writes to foreign memory regions

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/cc3ca5fb64666cfb1860c997333b0cc43f10fcc71a4a4840e47815fd659b907d

Verdict:

Malware

YARA:

7 match(es)

Tags:

AutoIt Decompiled Executable PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/5621b94ee22762740d162c91ea1991f4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cc3ca5fb64666cfb1860c997333b0cc43f10fcc71a4a4840e47815fd659b907d/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-12-08 14:50:34 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

29 of 38 (76.32%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zq6kl63emzwpwgdazgltgoymyq7rb7ghdjfeqqhepak72zm3sb6q._file

Verdict:

malicious

Label(s):

formbook

autoit

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan

Link:

https://tria.ge/reports/251208-r7xkhswrfw/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

Formbook payload

Formbook

Formbook family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b0fa2585-f269-4f2e-947c-4b87afd82976

Unpacked files

SH256 hash:

80858ac79c0b8d117c58bf3bae85004fded91c812dd684274a9a7349730d9630

MD5 hash:

2efeda40bedf4271be629571de4798de

SHA1 hash:

67fe925769506d614f3c8d201f10cf44bc4b547e

Link:

https://www.unpac.me/results/b05ea5ba-c743-46ab-9aef-a9ee93c76e01/

SH256 hash:

792b15d3a2e4bda9eb56d5d304340ab833da5eb7fabc6a1e05bec6220a5147ec

MD5 hash:

f6d35bda4f0ed16d0f68cbdd6c112242

SHA1 hash:

e2db2d7f6a21882e0e6a25a55b52811fe16998f3

Link:

https://www.unpac.me/results/b05ea5ba-c743-46ab-9aef-a9ee93c76e01/

SH256 hash:

cc3ca5fb64666cfb1860c997333b0cc43f10fcc71a4a4840e47815fd659b907d

MD5 hash:

5621b94ee22762740d162c91ea1991f4

SHA1 hash:

e64928277c79eebec35154d541e152d9513600ab

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/b05ea5ba-c743-46ab-9aef-a9ee93c76e01/

Parent samples :

49b7629b41572ef6c7f0f8666d45ded1e2d18609782c3592443786073559fd4f
cc3ca5fb64666cfb1860c997333b0cc43f10fcc71a4a4840e47815fd659b907d

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cc3ca5fb6466/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cc3ca5fb64666cfb1860c997333b0cc43f10fcc71a4a4840e47815fd659b907d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/