MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d38596b6c13b0abd45ff0c5348c94c59692977877b20e242c09bf05fc5c0244b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 16
| SHA256 hash: | d38596b6c13b0abd45ff0c5348c94c59692977877b20e242c09bf05fc5c0244b |
|---|---|
| SHA3-384 hash: | 83c21bf46ce835b211671ca67a24e90f98b5b74d9a7f77c5e9976ae9c44f5fe18d0e64b6be93bd9e61dc24a7c8512d53 |
| SHA1 hash: | 69259ce5a6dab74533db4a8a40ab209d3818395c |
| MD5 hash: | c6516eace7471ec622d5d48ded8c6277 |
| humanhash: | eight-kilo-football-north |
| File name: | REQUEST FOR QUOTATION.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 943'624 bytes |
| First seen: | 2025-05-21 06:41:26 UTC |
| Last seen: | 2025-05-21 06:43:25 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 24576:desslFP9rSl/ZtXRyJDBE1lBXywL58casu:desslXOanEbcFcasu |
| Threatray | 14 similar samples on MalwareBazaar |
| TLSH | T15215F10072298C03D8BB0AF40564E3B647B55E9EA931D6C28EEA7CCF38D5F942E54B53 |
| TrID | 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10522/11/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4504/4/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Magika | pebin |
| dhash icon | 7ffedaf6e6e4d0c0 (14 x SnakeKeylogger, 8 x Formbook, 5 x AgentTesla) |
| Reporter |  lowmal3 |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
2
# of downloads :
460
Origin country :
DEVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
REQUEST FOR QUOTATION.exe
Verdict:
Malicious activity
Analysis date:
2025-05-21 06:46:13 UTC
Tags:
netreactor
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.1%
Tags:
virus spawn msil
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
expired-cert invalid-signature obfuscated packed packed packer_detected signed vbnet
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
FormBook, PureLog Stealer
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected FormBook
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Score:
99%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.Kepavll
Status:
Malicious
First seen:
2025-05-21 03:07:47 UTC
File Type:
PE (.Net Exe)
Extracted files:
19
AV detection:
31 of 38 (81.58%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
unc_loader_037
formbook
Similar samples:
+ 4 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
discovery execution
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
d38596b6c13b0abd45ff0c5348c94c59692977877b20e242c09bf05fc5c0244b
MD5 hash:
c6516eace7471ec622d5d48ded8c6277
SHA1 hash:
69259ce5a6dab74533db4a8a40ab209d3818395c
SH256 hash:
0656f59c9e7cfa07d64cf4cd7d85ebd9b4399893cc853f3d1d37cca622d1f815
MD5 hash:
e4a8fe009b340647108a98105600f476
SHA1 hash:
03193855202feecd4bc542876855e706a243f13b
SH256 hash:
3fd31ea061a3441a8e90ddfbf9f1714e734fe530876940c5d27907148ca9abed
MD5 hash:
e86695a32bdcd5487f016b707fc55767
SHA1 hash:
5fc318102d074cf0547dd8d5ed50dd6e652b9e9c
SH256 hash:
e1f52d6c812cce326206f99e26533119af4b425012e7ee06b98fe23726066734
MD5 hash:
fb63f4ea55af161db87f101ab9dc0aaf
SHA1 hash:
9cda9e89d1187fdc9446702593609cbe1906c3b6
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
f620d353ffcc4543e3d87c551b79fb0f98513bafc286080427a455e2b299fc8c
MD5 hash:
f0bff35993ad01de3e217d3d6c0f1177
SHA1 hash:
0a2431cf15a72408280b165d1cb37898176a3619
Malware family:
zgRAT
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables signed with stolen, revoked or invalid certificates |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.