MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d2147f41f72ea6ee9790542e8ed0cd4bfaa968033b39ca7934a1304a0f26cef8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 12
| SHA256 hash: | d2147f41f72ea6ee9790542e8ed0cd4bfaa968033b39ca7934a1304a0f26cef8 |
|---|---|
| SHA3-384 hash: | 012339dde0f6f44c6892194c1623570c9e5351ec6b1076c4e3c4e83f9b8c90a641dc7475e1ac4aa5c57d1f2427813d6b |
| SHA1 hash: | ecc6b1c264ff1d0dc05fcf544f5e6cc69ae07b78 |
| MD5 hash: | 527e5345aa1ada22a2152cebb9d47c9f |
| humanhash: | jersey-orange-michigan-virginia |
| File name: | d2147f41f72ea6ee9790542e8ed0cd4bfaa968033b39ca7934a1304a0f26cef8 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 1'062'400 bytes |
| First seen: | 2025-04-08 08:52:36 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | fc6683d30d9f25244a50fd5357825e79 (92 x Formbook, 52 x AgentTesla, 23 x SnakeKeylogger) |
| ssdeep | 12288:/quErHF6xC9D6DmR1J98w4oknqOOCyQfv3MlKDh+sLM1Sc1QCfor/Ft6I:Grl6kD68JmlotQfke88cVqdt6I |
| Threatray | 55 similar samples on MalwareBazaar |
| TLSH | T1FA3534BDBCD4E92EC9A40FF4C76A98D04D1DBF682BF8609BE6B43E5994393014859133 |
| TrID | 31.3% (.EXE) UPX compressed Win32 Executable (27066/9/6) 30.7% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 12.1% (.EXE) Win64 Executable (generic) (10522/11/4) 7.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 5.8% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| Magika | pebin |
| dhash icon | d89cb4a49a9aa2d4 (2 x Formbook, 1 x SnakeKeylogger) |
| Reporter |  adrian__luca |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
415
Origin country :
HUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d2147f41f72ea6ee9790542e8ed0cd4bfaa968033b39ca7934a1304a0f26cef8
Verdict:
No threats detected
Analysis date:
2025-04-08 16:10:13 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
97.4%
Tags:
autoit virus spawn
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
anti-debug autoit cmdkey compiled-script extrac32 hacktool lolbin microsoft_visual_cc packed packed packed packer_detected upx
Verdict:
Malicious
Labled as:
Trojan.Generic
Verdict:
Malicious
Result
Threat name:
FormBook
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Score:
99%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.AutoitInject
Status:
Malicious
First seen:
2025-03-31 01:08:38 UTC
File Type:
PE (Exe)
Extracted files:
43
AV detection:
22 of 24 (91.67%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
unc_loader_036
formbook
Similar samples:
+ 45 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
discovery upx
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Verdict:
Malicious
Tags:
trojan Win.Dropper.njRAT-6971240-0
YARA:
SUSP_Imphash_Mar23_3
Unpacked files
SH256 hash:
d2147f41f72ea6ee9790542e8ed0cd4bfaa968033b39ca7934a1304a0f26cef8
MD5 hash:
527e5345aa1ada22a2152cebb9d47c9f
SHA1 hash:
ecc6b1c264ff1d0dc05fcf544f5e6cc69ae07b78
SH256 hash:
7198028a462896d80556d9efcb91b2bc228f1ca5753a7bdc8d396a9a1fc0abe2
MD5 hash:
993578f2ad9288e9fbe26cd0825d1259
SHA1 hash:
5d5fb7a3695214f4cb2172c5b1bf5ed71a932bcc
Detections:
AutoIT_Compiled
SH256 hash:
422ccdf0cf7f83b005542ea6d285e76d19c0f2cb0cd2ad9d9677e05ae1d562f3
MD5 hash:
0f0bfd4099eaaaedd8d9e5e1af271ee6
SHA1 hash:
677e9eb3d641d25e58f6d41bbcc2b013129b1548
SH256 hash:
0344138a2d14fa91a4dfc22a455a9b364ad75ebbd41ce143c6671207ad19164b
MD5 hash:
c9a1d894aee85d5e122ecab7446f1d96
SHA1 hash:
8cf4ac47843348e45d2fa892514468acdbd9d880
Detections:
win_formbook_g0
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_no_import_table |
|---|---|
| Description: | Detect pe file that no import table |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | SUSP_Imphash_Mar23_3 |
|---|---|
| Author: | Arnim Rupp (https://github.com/ruppde) |
| Description: | Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits |
| Reference: | Internal Research |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
| Rule name: | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser |
|---|---|
| Author: | malware-lu |
| Rule name: | upx_largefile |
|---|---|
| Author: | k3nr9 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| AUTH_API | Manipulates User Authorization | ADVAPI32.dll::GetAce |
| MULTIMEDIA_API | Can Play Multimedia | WINMM.dll::timeGetTime |
| WIN_BASE_API | Uses Win Base API | KERNEL32.DLL::LoadLibraryA |
| WIN_NETWORK_API | Supports Windows Networking | MPR.dll::WNetUseConnectionW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.