MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea50d3b284ad8dadcff8cb52541a9324404928b60d2ec521a04bf9762582c854. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	ea50d3b284ad8dadcff8cb52541a9324404928b60d2ec521a04bf9762582c854
SHA3-384 hash:	59ebbd6e2332a1ad942863644c9eee167242828f36e0c42c3d9a3786870c9faa3cf218ba9b041dbeabffb4f3271e89dc
SHA1 hash:	71b6ec6e2a1a7506f7d25e84c4f936d70089e072
MD5 hash:	7326f6fa581c06af70d264d4407eb584
humanhash:	spring-grey-friend-hotel
File name:	nethost.dll
Download:	download sample
Signature	Formbook Create hunting rule
File size:	487'912 bytes
First seen:	2025-02-18 17:30:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	6144:hSFa/Y4stjCWIVDsunoZZNciRNUxwMzdrlfzNoACLbWausSZTtpwXW5ku5PogzhQ:0Fa/Y4sUhs9nordewTtpwu5Pogzhzkh9
Threatray	35 similar samples on MalwareBazaar
TLSH	T1B5A4DABE59625139DA4A40F82445876255B1B73B03B41FF311AED130271BAB2EED33F9
TrID	39.8% (.EXE) Generic Win/DOS Executable (2002/3) 39.7% (.EXE) DOS Executable Generic (2000/1) 20.0% (.SCORE) Music Craft Score (1007/6) 0.3% (.DBF) Sybase iAnywhere database files (19/3)
Magika	pebin
Reporter	JAMESWT_WT
Tags:	exe FormBook signed tumbetgirislinki-fit

Code Signing Certificate

Organisation:	Take-Two Interactive Software, Inc.
Issuer:	VeriSign Class 3 Code Signing 2010 CA
Algorithm:	sha1WithRSAEncryption
Valid from:	2011-09-21T00:00:00Z
Valid to:	2013-09-20T23:59:59Z
Serial number:	695043d68f15550fd5db370fa8817b04
Intelligence:	20 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	5d269a2e2102e52ecbbae4d3dd27cf260fd6b1edf83887802f05a9411efa8c44
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

464

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b4c511a0fd713c335b919a

Tags:

injection obfusc virus

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/ea50d3b284ad8dadcff8cb52541a9324404928b60d2ec521a04bf9762582c854

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/67cc09ec-de5d-4ace-b2a8-7515d2013fb0

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1618196

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

56%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/ea50d3b284ad8dadcff8cb52541a9324404928b60d2ec521a04bf9762582c854

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ea50d3b284ad8dadcff8cb52541a9324404928b60d2ec521a04bf9762582c854/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5jinhmuevwg23t7yznjfiguteraeskfwbuxmkinajp4xmjmczbka._file

Verdict:

malicious

Label(s):

formbook

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/250218-v3sbsavkfk/

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/8e346558-4303-4af5-9068-95cd6126d4b9

Unpacked files

SH256 hash:

ea50d3b284ad8dadcff8cb52541a9324404928b60d2ec521a04bf9762582c854

MD5 hash:

7326f6fa581c06af70d264d4407eb584

SHA1 hash:

71b6ec6e2a1a7506f7d25e84c4f936d70089e072

Link:

https://www.unpac.me/results/ddc6cabe-89d7-4734-bea8-d7cb29d936bd/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ea50d3b284ad/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ea50d3b284ad8dadcff8cb52541a9324404928b60d2ec521a04bf9762582c854

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample