MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e24f9120926562202bcf833069ec53ebed149c15eaed1a6e340a8c984787b9c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e24f9120926562202bcf833069ec53ebed149c15eaed1a6e340a8c984787b9c5
SHA3-384 hash: 99852afd3f03a125250160b27dc87a1641cb3ac7381a46a868e19e2684c86a33bcbb8a58c650e22721ad5a62dde0a315
SHA1 hash: 8210af71a55f5de073a3709c06a3bd89df7a5e7d
MD5 hash: 5c8d77dca63e225d534c5d1d9d4b5584
humanhash: oven-jig-alaska-music
File name:RFQ C07586GA..exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'696 bytes
First seen:2025-09-08 12:55:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1895460fffad9475fda0c84755ecfee1 (389 x Formbook, 119 x AgentTesla, 58 x a310Logger)
ssdeep 24576:v5EmXFtKaL4/oFe5T9yyXYfP1ijXdafS1Ys3mi/snRKkt9M6A55yWTK:vPVt/LZeJbInQRafSCs3mMkjg5MW
TLSH T1E245BF027381D062FFAB92734B56F6115BBC7A260123A62F13981D79FE701B1563E7A3
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ C07586GA..exe
Verdict:
No threats detected
Analysis date:
2025-09-08 12:57:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a6e249ee-2eb2-477b-bd8b-3214bd1b0377

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/26277/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68bed25eb20052598878fa49
Tags:
phishing autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug autoit cmd compiled-script evasive fingerprint keylogger lolbin microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/68bed2861b52c70384b76226/reports/6ec7c439-4c15-45cb-9c06-b52ec21d222b/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/e24f9120926562202bcf833069ec53ebed149c15eaed1a6e340a8c984787b9c5
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-05T09:04:00Z UTC
Last seen:
2025-09-05T09:04:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/e24f9120926562202bcf833069ec53ebed149c15eaed1a6e340a8c984787b9c5/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/951f5bd9-4b70-4bbb-a818-d687dad75d3b
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e24f9120926562202bcf833069ec53ebed149c15eaed1a6e340a8c984787b9c5
Verdict:
Malware
YARA:
7 match(es)
Tags:
AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/5c8d77dca63e225d534c5d1d9d4b5584
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e24f9120926562202bcf833069ec53ebed149c15eaed1a6e340a8c984787b9c5/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-09-05 13:15:53 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
28 of 36 (77.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4jhzciesmvrcak6pqmygt3ct5pwrjhav5lwru3rubkgjqr4hxhcq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
error
Formbook
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/250908-p6mmtacj6w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5d925f1c-b314-4ff0-81f5-1d6a92a41688
Unpacked files
SH256 hash:
e24f9120926562202bcf833069ec53ebed149c15eaed1a6e340a8c984787b9c5
MD5 hash:
5c8d77dca63e225d534c5d1d9d4b5584
SHA1 hash:
8210af71a55f5de073a3709c06a3bd89df7a5e7d
Link:
https://www.unpac.me/results/09383ccf-4bc2-4f09-81f2-16dbdc8f6af9/
SH256 hash:
6ab07e392db5c4e3f1429d4184485080b8bae0a8802c29f5a0d9ddaeb6c1a815
MD5 hash:
60821caa0579f07178dd789829e5acd8
SHA1 hash:
f3cdffc361d38183ab3b4f8ef3f7422194202760
Link:
https://www.unpac.me/results/09383ccf-4bc2-4f09-81f2-16dbdc8f6af9/
SH256 hash:
be47b46fba514f441b7215f62aa9122a1444de7947267ee0d3828f48460e710d
MD5 hash:
df811ce0323c1f33bda47c68f19a8196
SHA1 hash:
b91fd10cb915b75dbe75ac35dff2e7807756d301
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/09383ccf-4bc2-4f09-81f2-16dbdc8f6af9/
Parent samples :
e24f9120926562202bcf833069ec53ebed149c15eaed1a6e340a8c984787b9c5
dbadbbb3a09a0cfbb8f0ee1fe9b58e710ffb5cfaf5d48e86e10a0e8bb135042c
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e24f91209265/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e24f9120926562202bcf833069ec53ebed149c15eaed1a6e340a8c984787b9c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/26277/

Comments