MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcd7773d3de49732deec658eef474c08ef73bcd8cf8c39633196430aea9c1c22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcd7773d3de49732deec658eef474c08ef73bcd8cf8c39633196430aea9c1c22
SHA3-384 hash: 0204ae34283a75ab6fa7a1a18c95dbd98a6809d4c01d8b8fb4db81831fed4f09c4ae513a60b7ab7e5b8a563e79e9a695
SHA1 hash: 6ea32c1042a60dad17c63a40c1cb9b6ec6eebdbb
MD5 hash: ff707056b60744bf07476da83e86501c
humanhash: eleven-double-triple-oranges
File name:SecuriteInfo.com.Trojan.PackedNET.3346.17782.32683
Download: download sample
Signature Formbook
Create hunting rule
File size:784'384 bytes
First seen:2025-06-04 06:43:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:M8gkekE15neaa+M5rf1pyyppVTyD2w8WOOXUhTTkF11Kk+YqqBUxdfLHIhm:zgkekEreaa+M5rb9myr2GTTkF11Ejdf0
Threatray 1'986 similar samples on MalwareBazaar
TLSH T1DBF412103268C91BC5EF2BB962A2D2B467F4ACCC7312CB06AEC55DDF38D67429256347
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 64ccc69387867090 (3 x MassLogger, 2 x SnakeKeylogger, 2 x Formbook)
Reporter SecuriteInfoCom
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
475
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/7205/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3346.17782.32683.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=683febb58bd5d68a12e4e2eb
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/683feb11e336a33801e2e0a2/reports/efd1baf3-87c4-439e-8410-85eb45be0c4a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/dcd7773d3de49732deec658eef474c08ef73bcd8cf8c39633196430aea9c1c22
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a15d44d5-31d4-4c4c-81d3-09b2f136463a
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1705598
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Uses threadpools to delay analysis
Yara detected AntiVM3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/dcd7773d3de49732deec658eef474c08ef73bcd8cf8c39633196430aea9c1c22
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dcd7773d3de49732deec658eef474c08ef73bcd8cf8c39633196430aea9c1c22/
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-06-04 03:34:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
23
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3tlxopj54sltfxxmmwho6r2mbdxxhpgyz6gdsyzrszbqv2u4dqra._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
0e4ab27a7810885623f6116de2650615c3e1139f22f439c35bd2e99f03ac198d
Formbook
30fab0b3a404bf2df5fbaf4f3a9ba789d16266d5f6393c4d3e4c4b58544a9a34
Formbook
69c5a698e5440fda15f54b2737f3125a1f5d023ce120ce8e8af29b50fb17f51b
Formbook
7bb5c9e35f9f5810040621ea28a76b70dad305aab4b3ab4aa601c50f5454a8cf
Formbook
d2fcd0aa013349a6b6356132f39e7936ba6ba9d4dccc19ccee243165917bbe19
Formbook
+ 1'976 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/250604-hg5nrscr9x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e8d002f3-afef-4d2c-9b87-979ee0849fe5
Unpacked files
SH256 hash:
dcd7773d3de49732deec658eef474c08ef73bcd8cf8c39633196430aea9c1c22
MD5 hash:
ff707056b60744bf07476da83e86501c
SHA1 hash:
6ea32c1042a60dad17c63a40c1cb9b6ec6eebdbb
Link:
https://www.unpac.me/results/4b90a318-1155-4911-ad6a-9b68a73a6268/
SH256 hash:
d0e634dc742a229560bffd6daa4fa6b2d8cc78c67b0349bc137ea2bd52396337
MD5 hash:
0919b32872b8bcdbfa32d9a14a597c32
SHA1 hash:
4543df4c89c78f4d73ddf06257830c955ce5761b
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/4b90a318-1155-4911-ad6a-9b68a73a6268/
Parent samples :
0e4ab27a7810885623f6116de2650615c3e1139f22f439c35bd2e99f03ac198d
69c5a698e5440fda15f54b2737f3125a1f5d023ce120ce8e8af29b50fb17f51b
30fab0b3a404bf2df5fbaf4f3a9ba789d16266d5f6393c4d3e4c4b58544a9a34
dcd7773d3de49732deec658eef474c08ef73bcd8cf8c39633196430aea9c1c22
4b045ea170a2d34ceeb3edec6de46c4dec90304e9a1937e28aff7cffbc44c0c8
3344e103d7a8b9be17df65de8a5e2d4788dbcc19e4cdd41bebf59641a57d6f94
cd329f54525e470e879f7bd111f4103cc63b412549ec6be25d69bebc78ed4ac2
SH256 hash:
00383de0838a17a8d61ca4375fb8b275297337d6cce73afe108efa35018058fc
MD5 hash:
9850dea4433e133e33091b18c7a6bb32
SHA1 hash:
d739029a85827add4061388535457d264f22ac7c
Link:
https://www.unpac.me/results/4b90a318-1155-4911-ad6a-9b68a73a6268/
SH256 hash:
0ba19e47361161adcf4b9be425f9303afc7be6f95fab917cad4164030a6435af
MD5 hash:
07db14eb78f8e4a49802a87280db8f1a
SHA1 hash:
e349ad82e7ade3d20f3d73ac560c4f2b19b600a7
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/4b90a318-1155-4911-ad6a-9b68a73a6268/
SH256 hash:
3a492f089a7f5173cd3e386aeb5156771eeec8b4a227c68726a460ed98a28fc3
MD5 hash:
fc2b3f740c2bfa29d09a99a5ddb391f9
SHA1 hash:
a4117452f07181835cfcdbd2ed69b75b486bdfdd
Link:
https://www.unpac.me/results/4b90a318-1155-4911-ad6a-9b68a73a6268/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dcd7773d3de4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dcd7773d3de49732deec658eef474c08ef73bcd8cf8c39633196430aea9c1c22

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/7205/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments