MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f31a0ca445b46f1e75c7bf2f7cdf8eba57561df4886d4a534124fdc15daed592. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f31a0ca445b46f1e75c7bf2f7cdf8eba57561df4886d4a534124fdc15daed592
SHA3-384 hash: 1a063bd547e4723f6e88145b35121e137e29fdd55431ed0e5c55276c157f6231f601dc15b465f42b8ce029d5eb4387fb
SHA1 hash: 58f848cf6c277c929a85185f818409eab0b2f477
MD5 hash: 5b3c096cbc811f192a8ec28229e7090b
humanhash: september-quebec-berlin-victor
File name:license.dll
Download: download sample
Signature Formbook
Create hunting rule
File size:810'528 bytes
First seen:2025-10-20 13:38:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 24576:6rkOYH/CqiAkFsZ08j1bcle4m7AeDlZuF:bCaj1bN4lYmF
Threatray 2'116 similar samples on MalwareBazaar
TLSH T18E05FB7E5D66A12ADA4E80FC244A4B5259B1B33B03B40FF70166913027179B2EED73F9
TrID 39.8% (.EXE) Generic Win/DOS Executable (2002/3)
39.7% (.EXE) DOS Executable Generic (2000/1)
20.0% (.SCORE) Music Craft Score (1007/6)
0.3% (.DBF) Sybase iAnywhere database files (19/3)
Magika pebin
Reporter Anonymous
Tags:exe FormBook signed

Code Signing Certificate

Organisation:Rockstar Games, Inc.
Issuer:Entrust Code Signing CA - OVCS1
Algorithm:sha256WithRSAEncryption
Valid from:2016-03-04T21:46:15Z
Valid to:2017-03-20T22:16:13Z
Serial number: 5057286e4033fcb0000000005565f5ac
Intelligence: 5 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 2b3678306617465e98c3d219da92cc6cb67d073ad21b7e17bd4101f37e8b4c01
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
license.dll
Verdict:
No threats detected
Analysis date:
2025-10-20 13:39:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1fe23df6-a95d-4a9e-83a5-ea0e61afb816

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/33457/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68f63b696dc4a08515e37e3e
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm expired-cert masquerade packed signed
Link:
https://www.filescan.io/uploads/68f63b703a79800405ec5794/reports/6a75d788-550f-4923-9cf5-a373e51a4f24/overview
Verdict:
Malicious
Labled as:
EFI/Agent.B trojan
Link:
https://www.hybrid-analysis.com/sample/f31a0ca445b46f1e75c7bf2f7cdf8eba57561df4886d4a534124fdc15daed592
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-19T21:29:00Z UTC
Last seen:
2025-10-22T11:04:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/f31a0ca445b46f1e75c7bf2f7cdf8eba57561df4886d4a534124fdc15daed592/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d182330a-89a3-4fb8-b885-966d1d840a9f
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f31a0ca445b46f1e75c7bf2f7cdf8eba57561df4886d4a534124fdc15daed592
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/5b3c096cbc811f192a8ec28229e7090b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f31a0ca445b46f1e75c7bf2f7cdf8eba57561df4886d4a534124fdc15daed592/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-10-20 00:09:08 UTC
File Type:
PE+ (UEFI)
AV detection:
12 of 38 (31.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6mnazjcfwrxr45ohx4xxzx4oxjlvmhpurbwuuu2bet64cxno2wja._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1f49a149f8a033e4d363aa8ab3bd5062aa2a096b121b0e925e799fd58f6ae367
Formbook
5c14649f341b72c153a02cc99d0852f7b0ded81f67a6513af7d188dfdce5a53e
Formbook
674b492473c8055decf69d41cf511912178127b104a0aac346770cc919aff31a
Formbook
688077d82e4713b8fd59087459590efc3e9e9bd195f36e201bb1ea617bfa4008
Formbook
a8cec5e33f7270e2e3d463c42aea7ee63825c8a4abe083be79ff3c6f123da63e
Formbook
b92ba639eab5cffac0ba3cd2e1ea98448be3063b2dd43a6e102e284734f9cb4f
Formbook
c948ad083bfa08ede99c76cdafa83866cb46983cbbe0df5aba6f9bebfe4abaf5
Formbook
e33dfc29e3a3d1e436ae244e934158aa3d47f58da62238e54d5c625f274a692e
Formbook
ea9a27a55dfd58ccf9973c85b662c8cf3ba048e3f753c802640dc8718bde696c
Formbook
error
Formbook
fd84f1f053fd28a546eec1387f8915b50fee957e4f1ea53ba33e95c3c23bfd1b
Formbook
+ 2'106 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251020-qxs9nswmaw/
Unpacked files
SH256 hash:
f31a0ca445b46f1e75c7bf2f7cdf8eba57561df4886d4a534124fdc15daed592
MD5 hash:
5b3c096cbc811f192a8ec28229e7090b
SHA1 hash:
58f848cf6c277c929a85185f818409eab0b2f477
Link:
https://www.unpac.me/results/5878afff-4322-4136-a1c3-66ffb226bb63/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f31a0ca445b46f1e75c7bf2f7cdf8eba57561df4886d4a534124fdc15daed592

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Windows_Generic_MalCert_6926a408
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/33457/

Comments