MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ce6fbf350e4ac03e03c66b9d4d8547e2bc6856a0aa343e771c9a63c3e55cf91b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 17
| SHA256 hash: | ce6fbf350e4ac03e03c66b9d4d8547e2bc6856a0aa343e771c9a63c3e55cf91b |
|---|---|
| SHA3-384 hash: | 23208d31ccfbaf315921be7522241695989ae5578f262bf43cc6caa0b7d7f304103a7eb1a189637e6d1d7ac68c8b0206 |
| SHA1 hash: | f76197ce9024f24cdcc06d81f980d610e6fce849 |
| MD5 hash: | 4a98b82cc3c2e3ea07e0928d74269d34 |
| humanhash: | monkey-hot-william-louisiana |
| File name: | ce6fbf350e4ac03e03c66b9d4d8547e2bc6856a0aa343e771c9a63c3e55cf91b |
| Download: | download sample |
| Signature | Formbook |
| File size: | 921'088 bytes |
| First seen: | 2025-08-12 15:01:06 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:CfeikywCvoFWB6J5qnre8kxpWeZA7cSI4rvlm:4eZABgEnmpPZMIp |
| Threatray | 125 similar samples on MalwareBazaar |
| TLSH | T1A815E02CBB396F32C1AC4F7A9A13551C83E44863E975F19A589D2CD20E79B54818FF83 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| dhash icon | 8aa7839bae32328e (17 x AveMariaRAT, 6 x Formbook, 3 x RemcosRAT) |
| Reporter |  adrian__luca |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
54
Origin country :
HUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
_ce6fbf350e4ac03e03c66b9d4d8547e2bc6856a0aa343e771c9a63c3e55cf91b.exe
Verdict:
No threats detected
Analysis date:
2025-08-12 21:07:01 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Detection(s):
Verdict:
Malicious
Score:
70%
Tags:
malware
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
base64 confuserex fingerprint lolbin msbuild obfuscated obfuscated packed reconnaissance regsvcs roboski schtasks vbc
Verdict:
Malicious
Labled as:
Trojan.Generic
Malware family:
KeyBase
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Gathering data
Gathering data
Verdict:
Malicious
Threat:
Trojan.MSIL.Noon
Threat name:
Win32.Trojan.Leonem
Status:
Malicious
First seen:
2025-07-31 18:01:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
30 of 38 (78.95%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
unc_loader_037
Similar samples:
+ 115 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
Win.Packed.Formbook-10023131-0
YARA:
n/a
Unpacked files
SH256 hash:
ce6fbf350e4ac03e03c66b9d4d8547e2bc6856a0aa343e771c9a63c3e55cf91b
MD5 hash:
4a98b82cc3c2e3ea07e0928d74269d34
SHA1 hash:
f76197ce9024f24cdcc06d81f980d610e6fce849
SH256 hash:
401f0b63c04fc4d12750d757ac2fa28e59d83d4775284ae11bd7743a70471241
MD5 hash:
cc5a1138c4dd37852d94c4fb44daa8b4
SHA1 hash:
5c9a04b121106614fca9332194ea50f10106b285
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
da45b64998403063b6d04bc46797480bb18dc512e0fb6cba4f59626fc44e995c
MD5 hash:
d3a04d7eb66294b429358931a3425e81
SHA1 hash:
dc8c90d08f0254dc83d170ad7c71dbab8898293a
SH256 hash:
6005f0e4563fef5e8abfdb88cacd5b3d8fd4cff04b1af93e8e01a9990f46d5c0
MD5 hash:
3f17ed370489371093c2a3d768cb6b07
SHA1 hash:
fb4f0ddcaf872e4c7850e4cefad59a2c62f54424
SH256 hash:
317d136ea4b6d5b5c2a63cd3a982133e9eec9ef4a38c0663d05ed33c9c433465
MD5 hash:
59c6faa6fc8597012b38722eb9f29576
SHA1 hash:
1aefa3dc41cede71968fbe036a69fb6276e38032
SH256 hash:
97e4ec465e3ec3de5bcf796c4ef8283c879e09cdf28221b6989599f0b71a50fa
MD5 hash:
e4c1c3d39a0b868b3b989c3a7a2cff03
SHA1 hash:
545204c3803c77abfac36e051609710ef9cb13ad
Detections:
win_formbook_g0
Malware family:
FormBook
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (GUARD_CF) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.