MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd95e35cfef21255b4e103c4fded9e6dbf9c8f45d52884397d93355355f62c6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd95e35cfef21255b4e103c4fded9e6dbf9c8f45d52884397d93355355f62c6c
SHA3-384 hash: e07e2814c39bf69a2319f0252bb25642c6d9fdb4e40c841a6f918235c0dd600f31733ab52b6cb6f3224ea0fc34e9c93c
SHA1 hash: 0cba2d411bbe2552d16dcf70e3eb651fd9731244
MD5 hash: 9252679e7241d1283c1788168bfceeed
humanhash: romeo-kilo-oven-johnny
File name:wensivragoodformebestthingsforbetter.hta
Download: download sample
Signature Formbook
Create hunting rule
File size:3'468 bytes
First seen:2025-06-24 15:47:35 UTC
Last seen:2025-06-24 18:00:07 UTC
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 24:jETAenvIBHv2rSG/v7LR3az+aPxARlDxgz/s3i7YVXEMs8PFRk2/oyoOnHBQICFR:4JIdiSYvHdaTPqWsyEBEMfFm2/VPHw2Q
Threatray 10 similar samples on MalwareBazaar
TLSH T1BF61E78D7B715CBC8B35C85BD42AB55FC1A08F93F04C697084A8D8A26F40D5CE58DE8E
Magika txt
Reporter abuse_ch
Tags:FormBook hta

Intelligence

File Origin
# of uploads :
2
# of downloads :
69
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.VBS.Agent-9.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.JS.Obfus-95.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=685ac8d032ed47a3a8d6be45
Tags:
obfuscate xtreme shell
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/dd95e35cfef21255b4e103c4fded9e6dbf9c8f45d52884397d93355355f62c6c/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/dd95e35cfef21255b4e103c4fded9e6dbf9c8f45d52884397d93355355f62c6c
Result
Threat name:
HTMLPhisher
Create hunting rule
Detection:
malicious
Classification:
spre.phis.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1722027
Signature
Command shell drops VBS files
Multi AV Scanner detection for submitted file
Potential malicious VBS script found (suspicious strings)
Sigma detected: Legitimate Application Dropped Script
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
System process connects to network (likely due to code injection or exploit)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected HtmlPhish44
Yara detected VBS Downloader Generic
Behaviour
Behavior Graph:
Download SVG
Score:
2%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/dd95e35cfef21255b4e103c4fded9e6dbf9c8f45d52884397d93355355f62c6c
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
Html
Link:
https://app.malva.re/file/9252679e7241d1283c1788168bfceeed
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd95e35cfef21255b4e103c4fded9e6dbf9c8f45d52884397d93355355f62c6c/
Threat name:
Script-WScript.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-06-24 05:48:52 UTC
File Type:
Text (HTML)
Extracted files:
1
AV detection:
9 of 24 (37.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3wk6gxh66ijflnhbapcp33m6nw7zzd2f2uuiiol5sm2vgvpwfrwa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1311aed7b08093746c808edea41d40fb2e8547a1bd86a2516cf7bf4f1f2075fd
Formbook
16792778b324bb4cd13bf84064b492ac9889ef809ccb5d2dfde7fae3df246787
Formbook
1f0573e1fd20ac052c3593942274cb9c892c3dba6766ddc5ccb557a01ffd5d97
Formbook
2c3f31c3ee37440e580e755960537e13511027a95e9539da15c3984a8a20be9f
Formbook
6cef2a9dfe5e84b67c901ff1e8d8544ed3f763b47a462f9014f3674db182e464
Formbook
6d0bd45ec3207831c1353180e2035b4247546d7e463e396d54ee66760621397c
Formbook
846550ef393aff69fac201e89e1d14ce1017707b13366e34eac547998396722a
Formbook
9028bd4ea1a87f165f5d1d0532485fad2a3df80686135985cfac70d3ca54c1f5
Formbook
b348772a94c8dacb5019a6f3f8a419dfd815ab0a075107a2d41ca02d0b69eb73
Formbook
error
Formbook
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery execution
Link:
https://tria.ge/reports/250624-s8v9hsvjt5/
Behaviour
Delays execution with timeout.exe
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Malware Config
Dropper Extraction:
http://149.154.158.50/xampp/cb/wp4096799-lost-in-space-wallpapers.jpg
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dd95e35cfef2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dd95e35cfef21255b4e103c4fded9e6dbf9c8f45d52884397d93355355f62c6c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

HTML Application (hta) hta dd95e35cfef21255b4e103c4fded9e6dbf9c8f45d52884397d93355355f62c6c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3569851/
  
Delivery method
Distributed via web download

Comments