MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7a183fa0b8ba92d00e0a4c046a410270618f767315a86f4019bfe26d550194a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7a183fa0b8ba92d00e0a4c046a410270618f767315a86f4019bfe26d550194a
SHA3-384 hash: 6a217567dbd36a2e342c125e4b2483dfc5eca7c5853c9369072f6669180c4eb5a08ab9f33535dd086f6e235473497bda
SHA1 hash: 4bccb85999a4f2035d456487100ed5403d8cfcb2
MD5 hash: 665349c0fd5556da39fc470fe98d6ba0
humanhash: asparagus-fruit-nebraska-mountain
File name:d7a183fa0b8ba92d00e0a4c046a410270618f767315a86f4019bfe26d550194a
Download: download sample
Signature Formbook
Create hunting rule
File size:735'232 bytes
First seen:2025-07-07 14:10:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:ZCa5SiRFrWqbajhiiRXd2rQUOvE8iyKK2jM4e+oQnAkktpeIDAQa9doBLbOIz:oli/W5hiMd20UOvE8iBCxQn5CjAr9CBD
Threatray 3'801 similar samples on MalwareBazaar
TLSH T1ECF41245B7D6DA62C9F843F01972E3B5137ABECE6401D34FA9EDECDB79213482856280
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
24
Origin country :
HU HU
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12758/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686bd59bc9eb974737676919
Tags:
virus krypt msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Sending a custom TCP request
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
krypt packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/686bd56c469cec4249ace7a5/reports/af6e50f0-b8c0-4b9b-b9bf-30de4684f28b/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/d7a183fa0b8ba92d00e0a4c046a410270618f767315a86f4019bfe26d550194a
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/932a4cfa-fae7-4864-af1a-53d3f52b748d
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d7a183fa0b8ba92d00e0a4c046a410270618f767315a86f4019bfe26d550194a
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable PE (Portable Executable) SOS: 0.01 Win 32 Exe x86
Link:
https://app.malva.re/file/665349c0fd5556da39fc470fe98d6ba0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7a183fa0b8ba92d00e0a4c046a410270618f767315a86f4019bfe26d550194a/
Threat name:
ByteCode-MSIL.Trojan.VIPKeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-06-18 08:52:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
27 of 38 (71.05%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=26qyh6qlrous2ahautaenjaqe4dbr53hgfnin5abtp7cnvkqdffa._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
216aa0125486b52ee78d537de24fb8b4fdcea3ff81b5b85f9bef070026a796cc
Formbook
44bcdcc19976200147601f72c903a84f73d79a82782af77a5e4da96b791fce73
Formbook
5e1fee190f1c11da7c2e38e1d4430c301919c87b7629389a56f48bcb4c6d84e3
Formbook
7a2a7f0806c0d8a61652d6e5533d4057bfef71c0b794e07772914be2296852de
Formbook
+ 3'791 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/250707-rg6qhasqx6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0e630667-b16c-45d7-ac81-dfe21b9c15c3
Unpacked files
SH256 hash:
d7a183fa0b8ba92d00e0a4c046a410270618f767315a86f4019bfe26d550194a
MD5 hash:
665349c0fd5556da39fc470fe98d6ba0
SHA1 hash:
4bccb85999a4f2035d456487100ed5403d8cfcb2
Link:
https://www.unpac.me/results/abd466f1-083f-4e4f-abda-a8cff61a7773/
SH256 hash:
6247951f92a0c7e6ee21bae6f748be3ebea899b10ae6672eb5a971918a0b68b0
MD5 hash:
e8e4a329c82bfa27b4cfbaa23d564ed1
SHA1 hash:
009a7775bba4a18564de97e86df093fe9cd844c7
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/abd466f1-083f-4e4f-abda-a8cff61a7773/
Parent samples :
00f7ff43b4690c065497bdae404f265e1283d847b6e284408ae6ec73cc7dcd71
e66777ee4d792b1c933b9bff5d2777df26e5da6e3a5f2ae6e9e38e4e662644e5
9b4e541549ce7327a7fa91c7707365dec04a060b4b63b97798410658847f8c1c
e80896f3ce016957ff20d7b18f546daaead13afd31d7c8c8f94d4039b01db118
d7a183fa0b8ba92d00e0a4c046a410270618f767315a86f4019bfe26d550194a
446ac5b2673ba02db508a71c3c821a4f5b2f6d9b0f8e4af62a7b747dceae33a9
f1afab33fee564c87a2130d066e941f4fa5e6cef5e9368834063e71f793a353d
e8b879b31a0509b447b0975ee255f07ba148c0a6a90cdba08bc7172b820d35ae
SH256 hash:
4929b688b3a7c93dfcabd914c9ebd2a7ebf94c0c138578817f335b5bfa61e59c
MD5 hash:
84f9ee9f1faab2cdb5821e2afe05056a
SHA1 hash:
549bd01c7be5cea20eae1ad078374bf036781083
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/abd466f1-083f-4e4f-abda-a8cff61a7773/
SH256 hash:
70f61d5be5b17a39f894d4d914e74c7cc9e0c06b1b7ca83823cd705ce810ac8d
MD5 hash:
895343337bdcd007996eb9d3f26f088d
SHA1 hash:
bba01cdba5c804e4b53e46844fec72aa6e8c4283
Link:
https://www.unpac.me/results/abd466f1-083f-4e4f-abda-a8cff61a7773/
SH256 hash:
32215e1095a990490f672799778156d0cd5f0c779d71b4c8334c04ad56ec2a95
MD5 hash:
095e625f0fade5a6f3c4a22ea8bc459c
SHA1 hash:
e1a959c03eb0e0d4a8f21147846e0e7ae64cc33b
Link:
https://www.unpac.me/results/abd466f1-083f-4e4f-abda-a8cff61a7773/
SH256 hash:
b7991b06baa95fe1499d0134ff559e0c14113cffc8289e8a5115d43fc2317888
MD5 hash:
1c81b3c2a7b767234dde2877740becd9
SHA1 hash:
47e065c9b11960bfaaaad1b499a4bd27c82932b8
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/abd466f1-083f-4e4f-abda-a8cff61a7773/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:kevoreilly
Description:Formbook Payload
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:Runtime_Broker_Variant_1
Create hunting rule
Author:Sn0wFr0$t
Description:Detecting malicious Runtime Broker
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/12758/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_TRUST_INFORequires Elevated Execution (Unrestricted:true)high

Comments