MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc5ced17f0c85fef8a1fa466796a84fb83592eb7c8a86302d9b0cc9e5837c140. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc5ced17f0c85fef8a1fa466796a84fb83592eb7c8a86302d9b0cc9e5837c140
SHA3-384 hash: 778227dbc44c6b5034037ea7fa6df3bd614cd256b98a2ce3f7ff1fede639ad3a9f434666befd7c1f2d612b161b931ab6
SHA1 hash: 0b93ef56795109dce8b398912f0d1e10905bfb23
MD5 hash: 077bb61e9d3cc382319c34388faf2065
humanhash: west-eight-fanta-stream
File name:bin.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:286'720 bytes
First seen:2026-07-23 13:31:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 6144:CUfKmLz6X0pW29zRRVbFZH0QqhtCnuJv18w7wV6PSsrbsT:bKmLzjQ4FcNUa18mwV6PzAT
TLSH T1F05412AA9702319FD14F6A32DDF68231BE1C7AF559DAA80BE3910F4B3209CE4B341755
Magika pebin
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75808/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a service
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypt formbook microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/6a621802d215c9a9db8b281f/reports/8ca79e67-59ba-4248-815d-46c971bd0664/overview
Verdict:
Malicious
Labled as:
FormBook.Generic
Link:
https://www.hybrid-analysis.com/sample/dc5ced17f0c85fef8a1fa466796a84fb83592eb7c8a86302d9b0cc9e5837c140
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-04T13:30:00Z UTC
Last seen:
2026-07-22T11:02:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/dc5ced17f0c85fef8a1fa466796a84fb83592eb7c8a86302d9b0cc9e5837c140/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/20eeac1e-9558-4c10-815d-8384a944649f
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/dc5ced17f0c85fef8a1fa466796a84fb83592eb7c8a86302d9b0cc9e5837c140
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc5ced17f0c85fef8a1fa466796a84fb83592eb7c8a86302d9b0cc9e5837c140/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-07-05 22:36:00 UTC
File Type:
PE (Exe)
AV detection:
29 of 36 (80.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3roo2f7qzbp67cq7urths2ue7obvslvxzcuggawzwdgj4wbxyfaa._file
Verdict:
malicious
Label(s):
Formbook
Create hunting rule
Link:
https://reports.threatray.com/258b0a08-0d3a-409a-bf74-13f5d00f2d34
Similar samples:
949eb105fbe7d0c40f7f706002966081809592f518ee091494311292421d3f68
Formbook
bc5a3c85389bd5622f69605687fbaa401643805f189a3bec12cb5913f7eec3fd
Formbook
bd73efeddb6769a8b1f068a6f4361f042e838aaaa55cae27bb2f1be4d0f3237d
Formbook
c2474da768d306dfa0e4504d8d999dec37705232059734b25f78620fea2d53ce
Formbook
d59186e4e3aedd78c10d75f069b1babfea7a88beeec236a52cd6df30c2d9a381
Formbook
e568bda9bcb69f15cd39108fbd1dff583a26e1a9eb598240abf9c2b14f43d7aa
Formbook
edf43a512bbd4c90ce45a339181ad3f11f8bf091420a49d8913ac26d84767e39
Formbook
f4783cc1f0aa8fa431bd0b0f54d961e8337d18bde0cce4a956c3a5c9f97d5961
Formbook
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/260723-qtd1ksxyet/
Behaviour
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Family: Formbook
Formbook payload
Unpacked files
SH256 hash:
dc5ced17f0c85fef8a1fa466796a84fb83592eb7c8a86302d9b0cc9e5837c140
MD5 hash:
077bb61e9d3cc382319c34388faf2065
SHA1 hash:
0b93ef56795109dce8b398912f0d1e10905bfb23
Link:
https://www.unpac.me/results/ddf00008-212c-49b4-bec0-65625663ae06/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dc5ced17f0c8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe dc5ced17f0c85fef8a1fa466796a84fb83592eb7c8a86302d9b0cc9e5837c140

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/75808/
  
URLhaus
https://urlhaus.abuse.ch/url/3890810/
  
Delivery method
Distributed via web download

Comments