MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f93e0a8edc73edfe87b73735f8530375d26ccfc916c77a1cca7d20e864b90320. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 16

Intelligence 16 IOCs YARA 16 File information Comments

SHA256 hash:	f93e0a8edc73edfe87b73735f8530375d26ccfc916c77a1cca7d20e864b90320
SHA3-384 hash:	02010f61e96a472a6971850ca9dd77ae9e5ddbfb593fbaefb09935ce6445cc75b81d04d80602535e75b06583d965afd4
SHA1 hash:	627d93c82b205b58f97ab6edbf805528766f850e
MD5 hash:	2073ce7549d035339fd2122eb3078168
humanhash:	zulu-violet-avocado-maine
File name:	PO071725.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	712'192 bytes
First seen:	2025-07-28 07:47:51 UTC
Last seen:	2025-08-03 20:32:04 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	ef471c0edf1877cd5a881a6a8bf647b9 (83 x Formbook, 33 x Loki, 31 x Loda)
ssdeep	12288:FOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi6wSejeZhJrzGMlQE0susaUBmLoJuJ:Fq5TfcdHj4fmbLmDsuZUrs
Threatray	2'611 similar samples on MalwareBazaar
TLSH	T138E42241A08CC861E7943735E07A8ED416287E32DE863F4D67D9F60A78723836D86B7D
TrID	33.9% (.EXE) UPX compressed Win32 Executable (27066/9/6) 33.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 13.1% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.6% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter	adrian__luca
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

PO071725.exe

Verdict:

No threats detected

Analysis date:

2025-07-28 07:49:09 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/318f4d78-cf0d-4414-ae3f-49346082c69a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/17290/

Detection(s):

SecuriteInfo.com.W32.Trojan.VORE-2106.1542.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68872b6b0b4775fb21329647

Tags:

autoit virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Сreating synchronization primitives

Sending a custom TCP request

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/f93e0a8edc73edfe87b73735f8530375d26ccfc916c77a1cca7d20e864b90320

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5250868f-6558-4405-b47f-5ee1d6c27f17

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f93e0a8edc73edfe87b73735f8530375d26ccfc916c77a1cca7d20e864b90320

Verdict:

Malware

YARA:

5 match(es)

Tags:

AutoIt Decompiled Executable PE (Portable Executable) Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/2073ce7549d035339fd2122eb3078168

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f93e0a8edc73edfe87b73735f8530375d26ccfc916c77a1cca7d20e864b90320/

Verdict:

Malicious

Threat:

VHO:Trojan-Spy.Win32.Noon

Link:

https://tip.neiki.dev/file/f93e0a8edc73edfe87b73735f8530375d26ccfc916c77a1cca7d20e864b90320

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-07-28 00:26:27 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7e7avdw4opw75b5xg427quydoxjgzt6jc3dxuhgkpuqoqzfzamqa._file

Verdict:

malicious

Label(s):

autoit

unc_loader_036

formbook

Formbook

61d6bc63a0a6db062dd3f42a6ae0dec0a8990d445200660ce6346047128c2cc3

Formbook

72405ed5a8262e043ccba2e0042bd517774108ebd15c8b34e185735a7235ad92

Formbook

a46fbf2a22d696f5e2311d8f3276c2096d7dd29e427fffa26694d724ae74b412

Formbook

a4eac1a2891f56f37dbc860c6b56e8cd8d59972cd7faaf643854cb8860ca3d29

Formbook

c3c235915752db934ca00b7c30cbcb2b5d83c2a52400ac29ccc1bd66573c534f

Formbook

d4980a2c4b12511d3b4d42b321f438d239772eae4ea9806f3b2ffc11f707bbd6

Formbook

d4b7c4546aa9faa318db82d328bd3dfa9328afde05ffd3af725fa52483f4909b

Formbook

ec22dc6bd9f3c041b38773b2f365d66bf9fdb6a4f205e80744218f005bfef5ee

Formbook

f10a61792867b7b2d84daa851f8d24169a96cb70b55e09931a7ed2c01853634f

Formbook

+ 2'601 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook discovery rat spyware stealer trojan upx

Link:

https://tria.ge/reports/250728-jnb6gaxkz9/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

Formbook payload

Formbook

Formbook family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/2fa2a998-48b6-480f-b377-63a9965b3a25

Unpacked files

SH256 hash:

f93e0a8edc73edfe87b73735f8530375d26ccfc916c77a1cca7d20e864b90320

MD5 hash:

2073ce7549d035339fd2122eb3078168

SHA1 hash:

627d93c82b205b58f97ab6edbf805528766f850e

Link:

https://www.unpac.me/results/4d7df4e6-6efc-4fae-9647-92b1479f14d1/

SH256 hash:

9019ec295f34b3d764eaf7f53c840551e084c06305823737adee8a794fe9d70e

MD5 hash:

56fdf6eafeb8d7e8a6970858bfe65d51

SHA1 hash:

bca881073ee681255488342d2968dc3b75650ff0

Link:

https://www.unpac.me/results/4d7df4e6-6efc-4fae-9647-92b1479f14d1/

SH256 hash:

02077f4fe8a31f68111234524dbd4a8bafa0c52acc6f48b975ac9b68e23c43be

MD5 hash:

17c848215ea6def9d256830f3c3cf3ee

SHA1 hash:

6d32cbf595c968fb07822774453d21265e476ea5

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/4d7df4e6-6efc-4fae-9647-92b1479f14d1/

Parent samples :

f93e0a8edc73edfe87b73735f8530375d26ccfc916c77a1cca7d20e864b90320
cf6865fc7ac88881c24f2d6276c1898381ab11cefedca177eab385c4d9677149
2bf31de983be33ba7be87131513a7c4102766bda004768f481909c73482e5215
0effaf0dc6d8088a7a68bef26965aefc800665de5ab48a1ee70c482a6aeb79c5
b33b1499b2e2e5d5704d4d32bd1ccfbe345017dcb68f7392d6ef354207633235
0bbf77b0b55e802fad02e1d36fa5293ddc2860d187b35e61e0b51998f46a2312

SH256 hash:

2dea2be71ffd754e51512b5205b593594081f71c81e25f94d38752471f7c9604

MD5 hash:

dac58ef803efb3c0c0dbd9cf63674270

SHA1 hash:

11bcf37fcb98530c185348d866681a91b6b34df9

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/4d7df4e6-6efc-4fae-9647-92b1479f14d1/

SH256 hash:

c67720a70db23c2b58725b5ee9e67810a359201e21d200c0724afc7cd03a90a1

MD5 hash:

43d4f71e3291897414518404316b1ce0

SHA1 hash:

8cf1deabea79190d000aac4222c6e781dfb26569

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/4d7df4e6-6efc-4fae-9647-92b1479f14d1/

SH256 hash:

a96b00b201ff4766047e0abbd20f909d200b37fe3d9affc8a2f940fcf8818688

MD5 hash:

cbb310660c463cfcff2c0c9c7c261898

SHA1 hash:

a156d08bae8656c555c6c8c0c58985e8040ccfc0

Link:

https://www.unpac.me/results/4d7df4e6-6efc-4fae-9647-92b1479f14d1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f93e0a8edc73edfe87b73735f8530375d26ccfc916c77a1cca7d20e864b90320

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

exe f93e0a8edc73edfe87b73735f8530375d26ccfc916c77a1cca7d20e864b90320

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/17290/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::timeGetTime
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAce
WIN_BASE_API	Uses Win Base API	KERNEL32.DLL::LoadLibraryA
WIN_NETWORK_API	Supports Windows Networking	MPR.dll::WNetUseConnectionW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample