MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9acce956ed850bd5186d36b5fe4be4741269f7a69a9bb6e6b227a4d515104cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 16

Intelligence 16 IOCs YARA 7 File information Comments

SHA256 hash:	f9acce956ed850bd5186d36b5fe4be4741269f7a69a9bb6e6b227a4d515104cf
SHA3-384 hash:	44d289b420fa1fea143d43479ba2532ae7af5e5c4961ec8e56a352ca15f3bae7636b42c80ab0c847e578be0f04ff1e3b
SHA1 hash:	4ac5c4c2c3ed6cfe365dea17534464c4727745ea
MD5 hash:	2fbb57070bc1768e7e3d939c7cbc24c5
humanhash:	golf-crazy-nebraska-quebec
File name:	rADCB-Payment-SOA2025-PDF.exe
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'296'384 bytes
First seen:	2025-06-24 17:00:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0b768923437678ce375719e30b21693e (143 x Formbook, 25 x MassLogger, 22 x SnakeKeylogger)
ssdeep	24576:45EmXFtKaL4/oFe5T9yyXYfP1ijXdax4zax/CgfFn5LGVaWx:4PVt/LZeJbInQRax4AfFxK
Threatray	59 similar samples on MalwareBazaar
TLSH	T10155CF027381D062FFAB92334F5AF6115BBC79260123A62F13981DB9BD705B1563E7A3
TrID	40.3% (.EXE) Win64 Executable (generic) (10522/11/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter	FXOLabs
Tags:	exe FormBook

Intelligence

File Origin

# of uploads :

# of downloads :

540

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

rADCB-Payment-SOA2025-PDF.exe

Verdict:

No threats detected

Analysis date:

2025-06-24 17:02:45 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/9983f689-8eee-426b-adac-ad7a6b133a7e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/10953/

Detection(s):

SecuriteInfo.com.FileRepMalware.1765.31061.UNOFFICIAL

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685ad9c9b06783b9ebd6eedb

Tags:

autoit emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Сreating synchronization primitives

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script entropy fingerprint keylogger masquerade microsoft_visual_cc packed packed packer_detected

Link:

https://www.filescan.io/uploads/685ad9cd3faf8fcd7d3f92da/reports/107746b3-a7c3-4531-ad26-ff0a9891d142/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/f9acce956ed850bd5186d36b5fe4be4741269f7a69a9bb6e6b227a4d515104cf

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/527f7de8-2b30-484a-9b33-6e5818a2198e

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f9acce956ed850bd5186d36b5fe4be4741269f7a69a9bb6e6b227a4d515104cf

Verdict:

Malware

YARA:

7 match(es)

Tags:

AutoIt Decompiled Executable PE (Portable Executable) Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/2fbb57070bc1768e7e3d939c7cbc24c5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f9acce956ed850bd5186d36b5fe4be4741269f7a69a9bb6e6b227a4d515104cf/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/f9acce956ed850bd5186d36b5fe4be4741269f7a69a9bb6e6b227a4d515104cf

Threat name:

Win32.Worm.DorkBot

Status:

Malicious

First seen:

2025-06-24 12:58:29 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 37 (70.27%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7gwm5flo3bil2umg2nvv7zf6i5asnh32ngu3w3tlej5e2ukrathq._file

Verdict:

malicious

Label(s):

formbook

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/250624-vjc3raej3y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/7dd3ab38-d5cd-4e98-b4eb-17e527cbff03

Unpacked files

SH256 hash:

f9acce956ed850bd5186d36b5fe4be4741269f7a69a9bb6e6b227a4d515104cf

MD5 hash:

2fbb57070bc1768e7e3d939c7cbc24c5

SHA1 hash:

4ac5c4c2c3ed6cfe365dea17534464c4727745ea

Link:

https://www.unpac.me/results/1b0ae035-5903-4986-9e3f-12d377b9b158/

SH256 hash:

3e364fbea9dec2545eec5b8c2a4bb8d6cfff8ec802037e66f20e63b262e3c34b

MD5 hash:

44e56e48e6cc042449d3b995a2f61e21

SHA1 hash:

0022efd84e5159aa7a8ac7c038e57a22b161374f

Link:

https://www.unpac.me/results/1b0ae035-5903-4986-9e3f-12d377b9b158/

SH256 hash:

fd9c7144603c4d7c94883b8a96e7e9f19de8c5b84931574f31c2e61cb00e21c6

MD5 hash:

370a8a39a106b455ce52d2a8f9d427c4

SHA1 hash:

a54725c438c4b1f079030ce7a6a574182dbd0636

Detections:

win_formbook_g0

Link:

https://www.unpac.me/results/1b0ae035-5903-4986-9e3f-12d377b9b158/

Parent samples :

8e4d338e04b62302970a24e8bf76065d3cb7a3ba7a6afa409334ed0aa64b6842
5c098326cbd0227e4cc82be5c33dbe0cd39f42d760a0eb9fc7e92d72bce7183a
f9acce956ed850bd5186d36b5fe4be4741269f7a69a9bb6e6b227a4d515104cf
21581c6e5ae4f7700351c3a01e5669918b34cdc065853bcc7e526d32d874df3d
c2a5f75c484425f2f4ed272ce2ef58aecfd7207a60df81efcdc621ef2d5e8a0d
0099b0e34472867b89f491e1c08dddb1aec45f72ff843795343c2ecc2408ef15

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f9acce956ed8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f9acce956ed850bd5186d36b5fe4be4741269f7a69a9bb6e6b227a4d515104cf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

exe f9acce956ed850bd5186d36b5fe4be4741269f7a69a9bb6e6b227a4d515104cf

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/10953/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample