MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 df6da3ee9daf4cfd9047fa531202f860f6296e009f2f4eb0c1e2905cea319b09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 16
| SHA256 hash: | df6da3ee9daf4cfd9047fa531202f860f6296e009f2f4eb0c1e2905cea319b09 |
|---|---|
| SHA3-384 hash: | b4a32ce3153fdc11f5721dbb266f388ebd18761a913474224478013b6d036230b383038118b00bfdf08a82ebaed9bf14 |
| SHA1 hash: | 27a6d286b8628e9f893b16c8b7eb21fdcbd4d932 |
| MD5 hash: | 655b2032d2d707ba8d1bc433c415720a |
| humanhash: | london-winner-zulu-oranges |
| File name: | Unpaidpastduebalance.scr.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 969'216 bytes |
| First seen: | 2025-06-24 21:06:46 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger) |
| ssdeep | 24576:U0Tssg39ePQBkaVgKEB681bVzSiwx8884:U5sgN1ORKEA81bVKC88 |
| Threatray | 2 similar samples on MalwareBazaar |
| TLSH | T1C4251250366EDF57DAB90BF40400E67203F96EDE6411D30A8EEEBCE774A2B5015A17A3 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| Reporter |  James_inthe_box |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
434
Origin country :
USVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
rl_df6da3ee9daf4cfd9047fa531202f860f6296e009f2f4eb0c1e2905cea319b09
Verdict:
No threats detected
Analysis date:
2025-06-24 21:10:52 UTC
Tags:
netreactor
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Verdict:
Malicious
Score:
90.9%
Tags:
shell virus krypt
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
dotnet-loader entropy masquerade obfuscated packed packed packed packer_detected vbnet
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Malware family:
Formbook
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) Win 32 Exe x86
Verdict:
Malicious
Threat name:
ByteCode-MSIL.Trojan.MassLogger
Status:
Malicious
First seen:
2025-06-24 16:20:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
26 of 38 (68.42%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
unc_loader_037
formbook
Result
Malware family:
n/a
Score:
8/10
Tags:
discovery execution
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
df6da3ee9daf4cfd9047fa531202f860f6296e009f2f4eb0c1e2905cea319b09
MD5 hash:
655b2032d2d707ba8d1bc433c415720a
SHA1 hash:
27a6d286b8628e9f893b16c8b7eb21fdcbd4d932
SH256 hash:
73c0b4ada2fa5fa0d4ee04a1aefd1152c45b2ceaf16cb1821e6ed342cd628a35
MD5 hash:
7a4ba809cfde7de542a5bc1c9e8968fe
SHA1 hash:
26002e81158fe03bf15e411dc5feacdb79775d52
SH256 hash:
b840cb16ac88359bbfba834d19db7a1bb43faa143c25355e6a6413a95cb2cefb
MD5 hash:
ad119ce555fc11f933ed1d69afe4577b
SHA1 hash:
77c4380822a4bdd06caa5f493e93d01ae3845ddc
SH256 hash:
f3e295ba0594a04ddb3542c828344a0edcb4988dea4ed190b811eee577b3541b
MD5 hash:
69686558f90f21ff794355cd5dea7d94
SHA1 hash:
d8d3b9bce80ea63c6bf611224e530a94ddbe02bc
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
a8bd5a702dafb34488218e105859a965878e194badbb478af98d595a5cb0fcfc
MD5 hash:
f6b3b6affaa46cf2bd40c3661ca33600
SHA1 hash:
380e5ac461f23a9a3829948aa11152d1a47bc88b
Malware family:
FormBook
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.