MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf6865fc7ac88881c24f2d6276c1898381ab11cefedca177eab385c4d9677149. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 13

Intelligence 13 IOCs YARA 16 File information Comments

SHA256 hash:	cf6865fc7ac88881c24f2d6276c1898381ab11cefedca177eab385c4d9677149
SHA3-384 hash:	490a41178d565e28e6f199e974be075f539b710d4eb28786d3a7a860a1ab27461f8d94a92126d86285d3011875f917ed
SHA1 hash:	f7476bf69eaa221195362699cec38d6772c673bd
MD5 hash:	4d34f175e6b5fe33c7d3649e1c50bf96
humanhash:	maryland-magazine-alabama-north
File name:	cf6865fc7ac88881c24f2d6276c1898381ab11cefedca177eab385c4d9677149
Download:	download sample
Signature	Formbook Create hunting rule
File size:	716'800 bytes
First seen:	2025-08-12 14:05:53 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ef471c0edf1877cd5a881a6a8bf647b9 (83 x Formbook, 33 x Loki, 31 x Loda)
ssdeep	12288:FOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiRh7Lb2NowdvC+aDr9fwl8dP0Hj2:Fq5TfcdHj4fmbK7U3An1fTx0q
Threatray	2'736 similar samples on MalwareBazaar
TLSH	T184E42340E5C4CC61EAA03374917F9F911A25BE319CCA6F4D5B5AF287B8613076887B3E
TrID	33.9% (.EXE) UPX compressed Win32 Executable (27066/9/6) 33.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 13.1% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.6% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter	adrian__luca
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

cf6865fc7ac88881c24f2d6276c1898381ab11cefedca177eab385c4d9677149

Verdict:

No threats detected

Analysis date:

2025-08-12 16:43:41 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/bad72d37-304e-4e16-a3eb-5f6ce2e736a9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/20499/

Detection(s):

SecuriteInfo.com.W32.Trojan.VORE-2106.1542.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689b4b9afca70bd90e8f0788

Tags:

virus spawn

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Сreating synchronization primitives

Sending a custom TCP request

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/cf6865fc7ac88881c24f2d6276c1898381ab11cefedca177eab385c4d9677149

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7c43b016-a528-4f29-be10-e109af5314ee

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/cf6865fc7ac88881c24f2d6276c1898381ab11cefedca177eab385c4d9677149

Gathering data

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-07-22 04:36:04 UTC

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z5ugl7d2zceidqspfvrhnqmjqoa2weoo73okc57kwoc4jwlhofeq._file

Verdict:

malicious

Label(s):

autoit

unc_loader_036

formbook

Formbook

61d6bc63a0a6db062dd3f42a6ae0dec0a8990d445200660ce6346047128c2cc3

Formbook

825caca7729cb19432c87c581b6a16240d21f1f3903b81cc98184bd80aa01de2

Formbook

a46fbf2a22d696f5e2311d8f3276c2096d7dd29e427fffa26694d724ae74b412

Formbook

a4eac1a2891f56f37dbc860c6b56e8cd8d59972cd7faaf643854cb8860ca3d29

Formbook

c3c235915752db934ca00b7c30cbcb2b5d83c2a52400ac29ccc1bd66573c534f

Formbook

d4980a2c4b12511d3b4d42b321f438d239772eae4ea9806f3b2ffc11f707bbd6

Formbook

d4b7c4546aa9faa318db82d328bd3dfa9328afde05ffd3af725fa52483f4909b

Formbook

ec22dc6bd9f3c041b38773b2f365d66bf9fdb6a4f205e80744218f005bfef5ee

Formbook

f10a61792867b7b2d84daa851f8d24169a96cb70b55e09931a7ed2c01853634f

Formbook

+ 2'726 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan upx

Link:

https://tria.ge/reports/250812-r3z5va1nz5/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

Formbook payload

Formbook

Formbook family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/99dfb7f4-6396-46ae-b42d-df147b493c3c

Unpacked files

SH256 hash:

02077f4fe8a31f68111234524dbd4a8bafa0c52acc6f48b975ac9b68e23c43be

MD5 hash:

17c848215ea6def9d256830f3c3cf3ee

SHA1 hash:

6d32cbf595c968fb07822774453d21265e476ea5

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/68d4ae51-5025-4eff-8980-11c1026e9674/

Parent samples :

f93e0a8edc73edfe87b73735f8530375d26ccfc916c77a1cca7d20e864b90320
cf6865fc7ac88881c24f2d6276c1898381ab11cefedca177eab385c4d9677149
2bf31de983be33ba7be87131513a7c4102766bda004768f481909c73482e5215
0effaf0dc6d8088a7a68bef26965aefc800665de5ab48a1ee70c482a6aeb79c5
b33b1499b2e2e5d5704d4d32bd1ccfbe345017dcb68f7392d6ef354207633235
0bbf77b0b55e802fad02e1d36fa5293ddc2860d187b35e61e0b51998f46a2312

SH256 hash:

a675af9a7e6ccd74f8a931044bf8acf7b9a33d75921d3e841f61965666169328

MD5 hash:

3ea0c91e1d454375d05547349531be5c

SHA1 hash:

be53b23ee749585ac72c41fbadbfdeb86d8335ac

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/68d4ae51-5025-4eff-8980-11c1026e9674/

SH256 hash:

a96b00b201ff4766047e0abbd20f909d200b37fe3d9affc8a2f940fcf8818688

MD5 hash:

cbb310660c463cfcff2c0c9c7c261898

SHA1 hash:

a156d08bae8656c555c6c8c0c58985e8040ccfc0

Link:

https://www.unpac.me/results/68d4ae51-5025-4eff-8980-11c1026e9674/

SH256 hash:

cf6865fc7ac88881c24f2d6276c1898381ab11cefedca177eab385c4d9677149

MD5 hash:

4d34f175e6b5fe33c7d3649e1c50bf96

SHA1 hash:

f7476bf69eaa221195362699cec38d6772c673bd

Link:

https://www.unpac.me/results/68d4ae51-5025-4eff-8980-11c1026e9674/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/20499/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::timeGetTime
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAce
WIN_BASE_API	Uses Win Base API	KERNEL32.DLL::LoadLibraryA
WIN_NETWORK_API	Supports Windows Networking	MPR.dll::WNetUseConnectionW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample