MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4160d848ce8fc3d06604dbed868251d960839dc351673a5aec208ba48ebfc7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4160d848ce8fc3d06604dbed868251d960839dc351673a5aec208ba48ebfc7e
SHA3-384 hash: b7d92db67d891f2137fc1b528dab174ae32cf91ae721c995133b9d10373a9f26b85f608d7d454c426d378213dc71a48f
SHA1 hash: 82419849a98dbbc17d4ec5fd5f8b6d2fd06f302b
MD5 hash: 6cd8829b23e8e4646e107ed3759ef25a
humanhash: solar-butter-missouri-zulu
File name:NewCustomerPurchaseOrderpdf.scr.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'083'392 bytes
First seen:2026-01-19 14:47:11 UTC
Last seen:2026-02-05 15:17:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'793 x AgentTesla, 19'692 x Formbook, 12'274 x SnakeKeylogger)
ssdeep 24576:9n1dZDMjoMh4qaFV71Zvy8ZBC+EgLsmJaWV9CDs:p1dZojTiqaFx1Jy8/bfLsUQ
Threatray 2'520 similar samples on MalwareBazaar
TLSH T19235F1582719D207CA94DBB41AB1F2B81B6C2DEA7810E3165FDDBEEFB876B024D10153
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
114
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/10b85c68-2b03-4161-8e91-2962c1b550f7/
Malware family:
n/a
ID:
1
File name:
00fb8f93a2e57615c040cd74ac936f3c0972fe7b675be644a8d6f631dfabb74b.zip
Verdict:
Suspicious activity
Analysis date:
2026-01-17 08:06:28 UTC
Tags:
arch-exec
Link:
https://app.any.run/tasks/4f87e2da-c386-478b-81a0-089878a4ce09

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/49334/
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=696b4304ef906a21abcdec94
Tags:
virus krypt msil
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
explorer krypt lolbin masquerade packed stealer
Link:
https://www.filescan.io/uploads/696e43ff55805a763fe8ce9b/reports/df14e5aa-8609-47cd-9479-7830c97c59c2/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/f4160d848ce8fc3d06604dbed868251d960839dc351673a5aec208ba48ebfc7e
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-17T03:22:00Z UTC
Last seen:
2026-01-21T10:26:00Z UTC
Hits:
~1000
Detections:
PDM:Trojan.Win32.Generic Backdoor.Agent.HTTP.C&C Trojan-Spy.Win32.Noon.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb HEUR:Trojan-PSW.MSIL.Stealer.gen VHO:Trojan-PSW.Win32.ReaderDB.gen Trojan-Spy.Noon.HTTP.ServerRequest
Link:
https://opentip.kaspersky.com/f4160d848ce8fc3d06604dbed868251d960839dc351673a5aec208ba48ebfc7e/results?tab=lookup
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/313e08c6-2d9f-4efb-8bdc-33dc872cccb1
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f4160d848ce8fc3d06604dbed868251d960839dc351673a5aec208ba48ebfc7e
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.23 Win 32 Exe x86
Link:
https://app.malva.re/file/6cd8829b23e8e4646e107ed3759ef25a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f4160d848ce8fc3d06604dbed868251d960839dc351673a5aec208ba48ebfc7e/
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-01-17 06:01:45 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6qla3bem5d6d2btajw7nq2bfdwlaqoo4gulhhjnoyielushl7r7a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
172c3076e5d6bfe9089a1e092d1286e77337bc3680db32539e3a7bf69b7d0560
Formbook
3a279099e6b83675a0f1b4ad779734a1c718d6b19a9ab225c54be70c78108ab5
Formbook
4eef5964d4be888f65a3410d0f60fd3559021aff06bf1448c919e294b7ecb72e
Formbook
77be2ee5c55a9c5f20b6522fb6fbd174465481ad60b5143c95ee31e16fccaf8e
Formbook
99e787914a65e928c023070c9a029cf58d4e405e4952bbb1142b1c8e53edfcc6
Formbook
b824470ef9a3b58d253689fb4736e3c9f39aaacf1bee32cbf113f94117bd1d48
Formbook
dc868203fe63fc8e75865fcfe43849fc1a4fd6a845416dee9497834b158669eb
Formbook
e4ff62b66b02a6f78870344b002d83ae80391d1cc0b1651085f23f28d41f027b
Formbook
error
Formbook
f4160d848ce8fc3d06604dbed868251d960839dc351673a5aec208ba48ebfc7e
Formbook
+ 2'510 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/260119-r53zhsd14b/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Formbook payload
Formbook
Formbook family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3e94b8f1-cef4-4562-bd50-ad0b321618db
Unpacked files
SH256 hash:
f4160d848ce8fc3d06604dbed868251d960839dc351673a5aec208ba48ebfc7e
MD5 hash:
6cd8829b23e8e4646e107ed3759ef25a
SHA1 hash:
82419849a98dbbc17d4ec5fd5f8b6d2fd06f302b
Link:
https://www.unpac.me/results/4affc88b-5276-4716-bfaa-e59d45aa3994/
SH256 hash:
11fe0446a3ee4f3fbb1b0e8453f6c15f72f2d288cbf4462b10ff3f8739f6f3c6
MD5 hash:
50deae66f99ecd42ccf09115d4c94cca
SHA1 hash:
090bf618089f3c633ab697bd1feb0ad5feb61798
Link:
https://www.unpac.me/results/4affc88b-5276-4716-bfaa-e59d45aa3994/
SH256 hash:
02f61b375b5bcb516172a722d7842daff11811c4f96b849062e2993684537603
MD5 hash:
6fae0a8cd9e285757391c2dca0fd1983
SHA1 hash:
3a21662e5a6f97c377c4c703a960501a145e2f03
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/4affc88b-5276-4716-bfaa-e59d45aa3994/
SH256 hash:
2094497b3f255e8a87c2b757c2d70211bf9d57409352ccb7bfd396d41d332a93
MD5 hash:
cf4b62421ea5b6cc3c2e98c43cab27b3
SHA1 hash:
a35e74869129abb17e42a8670d71d6f75e6258dc
Link:
https://www.unpac.me/results/4affc88b-5276-4716-bfaa-e59d45aa3994/
SH256 hash:
83f731ca2b2297eea1592ba73700a69a704cbd69dac3d065c855669027a8adf0
MD5 hash:
85bbbbf468e67b56ff0df8a1b10e2408
SHA1 hash:
1554cc9831feb600d3a84ef4312941ad8d683dfa
Link:
https://www.unpac.me/results/4affc88b-5276-4716-bfaa-e59d45aa3994/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f4160d848ce8fc3d06604dbed868251d960839dc351673a5aec208ba48ebfc7e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/49334/

Comments