MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e1f4bf968e975bdb45e48107ef68200d53e96ee2598b44e1f424ab7e298b4e52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 18
| SHA256 hash: | e1f4bf968e975bdb45e48107ef68200d53e96ee2598b44e1f424ab7e298b4e52 |
|---|---|
| SHA3-384 hash: | 1363780fc302eb3f0cb8f0e4ac807277ae10c79989d160384fd7297687341ecd77126f4580b0cfb219917ecb404b68f8 |
| SHA1 hash: | 396335ee2795ebecde9a8abf439ab7dc44c8c932 |
| MD5 hash: | c55941da9a8d5d4b58c5712509d76147 |
| humanhash: | orange-mississippi-failed-robin |
| File name: | Payment_advic_0097766886.pif.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 849'920 bytes |
| First seen: | 2025-09-10 12:51:40 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:hkd4FvdddddcSxetUZ9zET7Rv6YnK8WK1efPKMggh8G52lOGpCZNQYsCEk4yqDLF:huuQXrCP98G5AwQYsCOyqDsnQZy2 |
| Threatray | 1'018 similar samples on MalwareBazaar |
| TLSH | T1EA05F120316C9827EA7A8BF00671D2B40FF8BE59A520D6CA9DD67DCF38B5F409A10757 |
| TrID | 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10522/11/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4504/4/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Magika | pebin |
| Reporter |  James_inthe_box |
| Tags: | exe FormBook |
Intelligence
File Origin
# of uploads :
1
# of downloads :
107
Origin country :
USVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Payment_advic_0097766886.pif.exe
Verdict:
No threats detected
Analysis date:
2025-09-10 12:54:46 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Verdict:
Malicious
Score:
90.2%
Tags:
virus msil
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
base64 bitmap formbook formbook lolbin masquerade msbuild obfuscated packed packed reconnaissance regsvcs rezer0 roboski schtasks stego vbc windows zero
Verdict:
Malicious
Labled as:
MSILHeracles.Generic
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-10T00:33:00Z UTC
Last seen:
2025-09-10T00:33:00Z UTC
Hits:
~1000
Detections:
Trojan-Dropper.Win32.Injector.sb Trojan.Win32.SpeedBit.sb Trojan.MSIL.Crypt.sb HEUR:Trojan.MSIL.Taskun.gen Backdoor.Win32.Blakken.sb Backdoor.Agent.HTTP.C&C Trojan.MSIL.Taskun.sb VHO:Backdoor.Win32.Agent.gen PDM:Trojan.Win32.Generic Trojan.Win32.Agent.sb Trojan-Spy.Win32.Noon.sb Trojan.MSIL.Inject.sb Trojan-Spy.Noon.HTTP.ServerRequest Trojan.MSIL.Agent.sb HEUR:Trojan.MSIL.Injector.gen
Malware family:
Formbook
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Gathering data
Detection:
formbook
Verdict:
Malicious
Threat:
Family.FORMBOOK
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2025-09-10 06:52:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
38
AV detection:
28 of 38 (73.68%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
unc_loader_037
formbook
Similar samples:
+ 1'008 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook campaign:ol06 discovery rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
e1f4bf968e975bdb45e48107ef68200d53e96ee2598b44e1f424ab7e298b4e52
MD5 hash:
c55941da9a8d5d4b58c5712509d76147
SHA1 hash:
396335ee2795ebecde9a8abf439ab7dc44c8c932
SH256 hash:
59bb038ad965ac718832bf97e5cdc4463e0fece4f1be2d7b4b10dcd38319e912
MD5 hash:
de6b0d8a49e8d9459abe376a34749ae8
SHA1 hash:
1bc3c905c181f71478b2ccf6424cfafc5f080922
Detections:
win_formbook_w0
win_formbook_g0
win_formbook_auto
FormBook
Windows_Trojan_Formbook
Formbook
SH256 hash:
4152ec3403262897fb74b3350b4621eda04b56db73410a4236ef711c6c6ced88
MD5 hash:
df7523234b646b70ef1308bfd9fdb1f1
SHA1 hash:
1fedcc04c8dcc9dd9f407d629e83ea0753b7cda9
SH256 hash:
12dda0cd3b378fbced3071df357733426bb09e47c31fcc3ba6273650f67895dc
MD5 hash:
773c55854eb467033abb78bc2b667f80
SHA1 hash:
54bfd694185cd257abb4ee6b477dba12b971b9b9
SH256 hash:
725e7d9edf82f1c1f571210b281a8e7aa7101bf226a855c51d447cc2f227a3cf
MD5 hash:
441c00d72363046657d82d47f8bf1984
SHA1 hash:
6f7b6b5dbd44522a18a4b6fd8d25200c591a18a4
SH256 hash:
3b7efba292347bdd2b2004df6ccb747ee5cb3a14ff6d17ed877de644d60d42dc
MD5 hash:
8d5b60e074e62965c17f8c19916c7bbc
SHA1 hash:
94e29c945103a6a924ffd58c46e8fba362918fe8
SH256 hash:
73ca0857f878447b7b45b0de2766a5f41b0838c82ff0f4e9d84e7f6bfedf3d49
MD5 hash:
d77720a21a42397e3bc5f39ef89c7219
SHA1 hash:
958717f965732c05e180e4b8789d64a423d4bf04
SH256 hash:
97fdfab5b30d0c686d72b579f472b987a0ff2c235d5fa4b8d476ded12ef2de85
MD5 hash:
4ef5ff4531485295d3ef1ec1f82932ad
SHA1 hash:
bc7421333011e69420021085c62a58aa33c219e7
SH256 hash:
dc31ced9db030528e03adf3a185935d0ae47a9a13ca1ed1be5169cbc023bbc86
MD5 hash:
d1baf78256c8a397bd72e168f60272ce
SHA1 hash:
c3c280e2a646eb63c97f1f0e6a07f960b94946fb
SH256 hash:
12f7dee4a475e74da2f047e3f71242c4485e72a48c1bfae96f8b25f5c190c95b
MD5 hash:
7a719e38f4560f9c9a60208ac8f2421b
SHA1 hash:
d30ba54ca5decb2ade54c8f03738baaa97f421b0
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
a07218767cb37a2eb228ddf96d25724848f368c446abe6ad0813387dfc603f98
MD5 hash:
af22bb92639cb98b8f09382c32c478ac
SHA1 hash:
d97ed60de226af9876769ac2e94185cf1b25d676
SH256 hash:
c2b4b3d9efb90920b66955a56920130db31d1451a621e2c98239634246aeabf1
MD5 hash:
29197ff4ff643436e9645873995d3f14
SHA1 hash:
e72b70a717b7357b3dcb6ab538750d742185fafa
SH256 hash:
5413f4bed400627950fce48e7915a7be0f25664e98efbc7af37dc49bb79b7728
MD5 hash:
904cc3dbcbe44506bae69616e31bab38
SHA1 hash:
fb6642591d5b32fb17725c10f040fb5858dd7038
SH256 hash:
208f30f5ea416b321cbaf4768dd3bddea682d0747509991e21f46a88fb2d0048
MD5 hash:
053eb6c500c3252aa6d8c28a604ba328
SHA1 hash:
df774410d4dddfd86bbc4f5dfe3e7ffc2c15672d
Detections:
win_formbook_w0
win_formbook_g0
win_formbook_auto
FormBook
Windows_Trojan_Formbook
Formbook
Malware family:
FormBook
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | CP_AllMal_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.