MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfc678a99a6bce4180cfe2bc45861694cca244977b850691a04737251c8bef30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfc678a99a6bce4180cfe2bc45861694cca244977b850691a04737251c8bef30
SHA3-384 hash: 4d0cfedf71e1e74d2b8434c7818bb864a0877e35b94ab6f18ffd18466b9a357656f8a7f3d30eeecbcd57ddd372b250aa
SHA1 hash: ebaac92273fa522f56b4cfcaa29bed195844a334
MD5 hash: 0d0b6dec210dfb1b54c21dc5d04806a5
humanhash: oranges-friend-steak-rugby
File name:cfc678a99a6bce4180cfe2bc45861694cca244977b850691a04737251c8bef30
Download: download sample
Signature Formbook
Create hunting rule
File size:767'488 bytes
First seen:2025-12-08 14:58:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:Jl26IRlr9yaQKulvdZKUy2HSk30zn2xLmRllkgxEJPzqBYdNDloIf/1P1s:Jl26iAlvKUyjk306xLmdSJPuo7Ts
Threatray 2'216 similar samples on MalwareBazaar
TLSH T109F40261729DCF02D4620FF86AA1C1B15BB55E9DA911D217CFE76CDFB83AB004860B93
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
HU HU
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f9a5de1e-27f9-4d76-bfba-15312098e931/
Malware family:
n/a
ID:
1
File name:
cfc678a99a6bce4180cfe2bc45861694cca244977b850691a04737251c8bef30.exe
Verdict:
No threats detected
Analysis date:
2025-12-08 15:01:29 UTC
Tags:
amsi-bypass
Link:
https://app.any.run/tasks/68f3023b-39c7-4441-b9ab-09a69f877e1f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/43264/
Detection(s):
SecuriteInfo.com.Trojan.Inject6.15708.28038.21705.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6936e7eedb58e1a2c22b8991
Tags:
virus shell msil
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/cfc678a99a6bce4180cfe2bc45861694cca244977b850691a04737251c8bef30
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-14T12:38:00Z UTC
Last seen:
2025-12-10T05:25:00Z UTC
Hits:
~1000
Detections:
VHO:Backdoor.Win32.Convagent.gen Backdoor.Agent.HTTP.C&C Trojan-Spy.Win32.Noon.sb Trojan.MSIL.Taskun.sb HEUR:Trojan-Spy.MSIL.Noon.gen Trojan-Spy.Noon.HTTP.ServerRequest PDM:Trojan.Win32.Generic Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb
Link:
https://opentip.kaspersky.com/cfc678a99a6bce4180cfe2bc45861694cca244977b850691a04737251c8bef30/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/94c214c7-cc15-4096-a931-82d9bf020927
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cfc678a99a6bce4180cfe2bc45861694cca244977b850691a04737251c8bef30
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.26 Win 32 Exe x86
Link:
https://app.malva.re/file/0d0b6dec210dfb1b54c21dc5d04806a5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cfc678a99a6bce4180cfe2bc45861694cca244977b850691a04737251c8bef30/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/cfc678a99a6bce4180cfe2bc45861694cca244977b850691a04737251c8bef30
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-11-14 15:53:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z7dhrkm2nphedagp4k6elbqwstgkerexpocqnenai43skhel54ya._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
33e3c3bacfaf4035d13503a8855e5f1c17b5801ea988e72e2bb939ab58c12f39
Formbook
7b96c0f4aee4bfb45eb29be64a5d469ad324112dae8dc5c69acce6954ec33b32
Formbook
7be16d08f76a1f88d6ff634df15d045d532e8a7b67827e21f4c7d71f37f3718b
Formbook
8ec0ad44c95b1b7190a2fcae723d0189bc0c814e08244b974c0e9fe51b19bd03
Formbook
aaa5b20a90d1f1755d39e6e228f8d4a4060d9da1451d9dd54a6e85fa2dd9ceef
Formbook
b5f7ce31c9333182fd55674e84e7a60e21cfdc92cf6b3b7286be53923a03386c
Formbook
da99e5e90a490e93120bd11d5bdb6226ad5e6fa21c10d5514b97d09b56dcc403
Formbook
ea250eba25fa7ecae8c440aff7a402f04b959b0722a8bfd068352bc31697322e
Formbook
error
Formbook
+ 2'206 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/251208-scelwsxjey/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a6c450aa-d58d-48c5-9189-2cb29e9accb6
Unpacked files
SH256 hash:
4755144f82a4a3fa80f43be3df88153647eb21497ca3dc4f025a1153053decc2
MD5 hash:
39274f692cae5cf33932f90258e4ad98
SHA1 hash:
054a3ecaf8abe838fe52a229bbba1a2755456653
Link:
https://www.unpac.me/results/0dc5a741-7402-40b2-be6a-60c56e60cc1a/
SH256 hash:
072240207fa3c69cbe6231a7f0cdd80db10f5a805211c8f9f400ed0ca58cb5db
MD5 hash:
e1d81cd81c1cb619097546b0f550e1ab
SHA1 hash:
1222d30fb0f4b23253714f5793996e2a709ff9e8
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/0dc5a741-7402-40b2-be6a-60c56e60cc1a/
SH256 hash:
13d261fe4a35935f5b355dffef95b8b242536a6c60bed33a4bf8c1e9987b9c3b
MD5 hash:
db24cfbfc2fb4dd4628510342b39df97
SHA1 hash:
7d8ee4e6efeb2bae6ab9e2e68696aa10ba80c085
Link:
https://www.unpac.me/results/0dc5a741-7402-40b2-be6a-60c56e60cc1a/
SH256 hash:
7d880902be9b6f690f3a951f854e261f905c6000b8ff86f50fa62f5c2b31f5db
MD5 hash:
65de8a8cc050f9536ae8837ee8404db5
SHA1 hash:
7ad502465b7c1dd5e5198d90f31c6fc186346680
Link:
https://www.unpac.me/results/0dc5a741-7402-40b2-be6a-60c56e60cc1a/
SH256 hash:
cfc678a99a6bce4180cfe2bc45861694cca244977b850691a04737251c8bef30
MD5 hash:
0d0b6dec210dfb1b54c21dc5d04806a5
SHA1 hash:
ebaac92273fa522f56b4cfcaa29bed195844a334
Link:
https://www.unpac.me/results/0dc5a741-7402-40b2-be6a-60c56e60cc1a/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/43264/

Comments