MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 df87753fe343afeb8e28ea947a446927be665c1ea7274e8e90c348257ce7ac57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 16
| SHA256 hash: | df87753fe343afeb8e28ea947a446927be665c1ea7274e8e90c348257ce7ac57 |
|---|---|
| SHA3-384 hash: | 7935cb8619d8b058773ea566719e0f37bb284bfcef0704ef74b8b1d486f28c10fef84b960f515b43493f4b966b693515 |
| SHA1 hash: | 8ea0620256d9bc1b16483e29f3e4e2058914d0ef |
| MD5 hash: | 24e0bc8a5e74ea5d2d94b7387c199ccc |
| humanhash: | winner-oscar-ten-hot |
| File name: | URGENT REQUEST FOR QUOTATION.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 1'080'840 bytes |
| First seen: | 2025-02-18 11:59:15 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 24576:qqxXIN453L0y5XsRw9c0asCIswbE1c5fW4c1FpC:JIN2QyGRs1vY4ZKC |
| Threatray | 4'521 similar samples on MalwareBazaar |
| TLSH | T17D35F1C03B327715DEA95A34D16ADEBA92B50E68B040BAF316DC7F87358C211AE1CF51 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| File icon (PE): |  |
| dhash icon | 8e8e8e9696969696 (7 x Formbook, 2 x SnakeKeylogger, 2 x VIPKeylogger) |
| Reporter |  threatcat_ch |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
487
Origin country :
CHVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
URGENT REQUEST FOR QUOTATION.exe
Verdict:
Malicious activity
Analysis date:
2025-02-18 12:00:18 UTC
Tags:
netreactor
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
93.3%
Tags:
dropper virus shell
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
invalid-signature keylogger obfuscated obfuscated packed packed packer_detected signed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
54 / 100
Signature
.NET source code contains potential unpacker
Contains functionality to log keystrokes (.Net Source)
Initial sample is a PE file and has a suspicious name
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Behaviour
Behavior Graph:
Score:
99%
Verdict:
Malware
File Type:
PE
Threat name:
ByteCode-MSIL.Trojan.Taskun
Status:
Malicious
First seen:
2025-02-18 02:38:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
23
AV detection:
23 of 38 (60.53%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
unknown_loader_037
captiveaaloader
Similar samples:
+ 4'511 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
discovery execution
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
df87753fe343afeb8e28ea947a446927be665c1ea7274e8e90c348257ce7ac57
MD5 hash:
24e0bc8a5e74ea5d2d94b7387c199ccc
SHA1 hash:
8ea0620256d9bc1b16483e29f3e4e2058914d0ef
SH256 hash:
52b2d001a6b47747eea4934feabad4de50a4f4c07abde55f6913bd0d9c463b91
MD5 hash:
deff10ee935fa9c6c344d8cb0d6b984a
SHA1 hash:
0ddf13f3d8f8b94d72bee2ff3776e95c2a06b6a4
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SH256 hash:
da6e588d8da451d89c72db668b5b113467302f48e23b85cafe51d28f3b95ec91
MD5 hash:
b302eb60dd6feaaeb118ae29b86afc90
SHA1 hash:
8810737d8dca2cfefd245aa72f2447e3e96ee91f
SH256 hash:
e3beb53e150dace07131afb5fc9f6c2c89e82e4afd5ac12c3db0dd3b2e70c9d7
MD5 hash:
a6906cecffa76d468f7042b5ef20e06e
SHA1 hash:
918b66aca3c672ee41013225b139aa47e4e7c091
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
2aac16ef81ec9f3dbf0e60ffb22d86fe8486d06e3029ded5d4bc9dd60f6a4789
MD5 hash:
ce897cfdf1d19420e1fc4ca581e9db32
SHA1 hash:
c578094620094ed30f8057b65e14b115b8a35d47
Detections:
win_formbook_g0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables signed with stolen, revoked or invalid certificates |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.