MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8e2a092d8fb171600ec33b4a2f7ab17ab14610e23d6dc81c53308d1a570a11d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8e2a092d8fb171600ec33b4a2f7ab17ab14610e23d6dc81c53308d1a570a11d
SHA3-384 hash: 12cab4f9e62f03de971b67303fbea73343d265f4ac605063995443e9a99e4ef6e2799d411c4b923b551be056d4423d69
SHA1 hash: c4b27765148c551c86c2c14a7a47b4173dc47563
MD5 hash: e90e84350d2a73be40ed8708d79b4e4a
humanhash: bravo-mango-leopard-fish
File name:COMMECIAL INVOICE AND DHL AWB TRACKING DETAILS.PDF.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:842'026 bytes
First seen:2025-06-24 12:19:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:cIaHX/NQgR1137E/rnxg+M5vmJoZwozVNL:cpXOW1sbxu5vXwozbL
TLSH T1FA0533F8906B636BE68E5968333522F084C0EF17DB1DAC2F9151C4EADC3655B394AC72
Magika zip
Reporter cocaman
Tags:DHL FormBook INVOICE zip


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL OFFICE <dhl@voltechqroup.com>" (likely spoofed)
Received: "from priceless-maxwell.45-133-74-43.plesk.page (unknown [45.133.74.43]) "
Date: "Tue, 24 Jun 2025 13:13:08 +0100"
Subject: "DHL SHIPMENTS NOTIFICATION : 39952312** ARRIVAL NOTICE"
Attachment: "COMMECIAL INVOICE AND DHL AWB TRACKING DETAILS.PDF.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
311
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:COMMECIAL INVOICE AND DHL AWB TRACKING DETAILS.exe
File size:1'294'848 bytes
SHA256 hash: 079877e37e8a515e9ecdd4445bbd4afba3ecccada4e612a3df7d81a3fa326209
MD5 hash: 200610eb1377279ef39a51cdf1bfbfcb
MIME type:application/x-dosexec
Signature Formbook
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FileRepMalware.26878.16348.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=685a6cd632ed47a3a8d6aea1
Tags:
autorun autoit emotet
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/e8e2a092d8fb171600ec33b4a2f7ab17ab14610e23d6dc81c53308d1a570a11d/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm anti-vm autoit compiled-script entropy evasive fingerprint keylogger lolbin masquerade microsoft_visual_cc mmc packed packed packer_detected tracker
Link:
https://www.filescan.io/uploads/685a97c666c4b5c0b99d81b8/reports/4fef6678-31a2-49e4-ab0d-b59912e20f24/overview
Verdict:
Suspicious
Labled as:
Trojan.Downloader
Link:
https://www.hybrid-analysis.com/sample/e8e2a092d8fb171600ec33b4a2f7ab17ab14610e23d6dc81c53308d1a570a11d
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/e8e2a092d8fb171600ec33b4a2f7ab17ab14610e23d6dc81c53308d1a570a11d
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/e8e2a092d8fb171600ec33b4a2f7ab17ab14610e23d6dc81c53308d1a570a11d
Verdict:
Malware
YARA:
3 match(es)
Tags:
AutoIt Decompiled Executable PE (Portable Executable) Suspect Zip Archive
Link:
https://app.malva.re/file/e90e84350d2a73be40ed8708d79b4e4a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8e2a092d8fb171600ec33b4a2f7ab17ab14610e23d6dc81c53308d1a570a11d/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-06-24 08:12:03 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5drkbewy7mlrmahmgo2kf55lc6vriyioeplnzaofgmendjlqueoq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/250624-pl81batsew/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
Drops startup file
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/e8e2a092d8fb171600ec33b4a2f7ab17ab14610e23d6dc81c53308d1a570a11d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip e8e2a092d8fb171600ec33b4a2f7ab17ab14610e23d6dc81c53308d1a570a11d

(this sample)

Formbook

Executable exe 079877e37e8a515e9ecdd4445bbd4afba3ecccada4e612a3df7d81a3fa326209

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 079877e37e8a515e9ecdd4445bbd4afba3ecccada4e612a3df7d81a3fa326209
  
Dropping
Formbook
  
Dropping
MD5 200610eb1377279ef39a51cdf1bfbfcb

Comments