MALICIOUS — 04e293d3a35fc2a8a1c90f28fa4d1c92412a04757035972fd49f47de0e5e5a9a.bin

MALICIOUS — 04e293d3a35fc2a8a1c90f28fa4d1c92412a04757035972fd49f47de0e5e5a9a.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Formbook family. 2 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 04e293d3a35fc2a8a1c90f28fa4d1c92412a04757035972fd49f47de0e5e5a9a
• SHA-1: ab332f0b1b72cae0727b85d96c6a0be0fd1e1b93
• MD5: 0542ade50c2fba4ec61499340cc21884
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 24576:8YYawfiZKUcBnCYoz49xjMnFtlB/LApclnWtALYKdjU2PwCKG2W1:8YYawq8UcBnCY+dzwQnWtALYqU2YA
• TLSH: T15C53125D357C9D00D8E3A1343F8489ACA9C867C7A8A895CADB32745007EDE735838DB6
• Submitted as: 04e293d3a35fc2a8a1c90f28fa4d1c92412a04757035972fd49f47de0e5e5a9a.bin
• File type: pe · Size: 1075200 bytes
• Verdict: malicious (97/100) · Family: Formbook

Source: MalShare · first seen 2026-08-03T13:27:32.469Z · SHA-256 verified

Detections (2 of 25 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
• Kaspersky (KVRT): UDS:Trojan-PSW.MSIL.Agensla.gen

MITRE ATT&CK

• T1543.003
• T1112
• T1105

Why this verdict

The malicious score of 97/100 is the fusion of 9 weighted signals:

• Memory forensics: 3 finding(s), e.g. RWX/private injected region in svchost.exe (pid 932) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Dropped a suspicious payload: 9429fb123c90f8d5130515bc7f73b0157a5bc3c6a7558f336c80cc2680b9dca2 - dynamic signal, weight 0.50, confidence 0.90
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
• Extracted Formbook config (0 C2) - engine signal, weight 0.45, confidence 0.60
• Embedded network infrastructure: 3.8.5.0 - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

22402 behavior events · 2 ATT&CK techniques · 29 dropped files.

Runtime network

• www.msftconnecttest.com
• searchapp.bundleassets.example
• desktop-hsgcbep
• ctldl.windowsupdate.com
• config.edge.skype.com
• www.bing.com
• msedge.api.cdp.microsoft.com
• dns.msftncsi.com
• watson.events.data.microsoft.com
• edge.microsoft.com
• aefd.nelreports.net
• www.msftncsi.com
• time.windows.com
• geo.prod.do.dsp.mp.microsoft.com
• geover.prod.do.dsp.mp.microsoft.com
• 192.168.122.112
• 224.0.0.252
• 192.168.122.1
• 192.168.122.255
• 192.168.122.108

Dropped files

• /opt/CAPEv2/storage/analyses/8917/files/9429fb123c90f8d5130515bc7f73b0157a5bc3c6a7558f336c80cc2680b9dca2 - 9429fb123c90f8d5130515bc7f73b0157a5bc3c6a7558f336c80cc2680b9dca2
• /opt/CAPEv2/storage/analyses/8917/files/96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
• /opt/CAPEv2/storage/analyses/8917/files/b768dba05f80dff550e4bbf90da1892263746889112fc91f6503ecd9d4bbd6da - b768dba05f80dff550e4bbf90da1892263746889112fc91f6503ecd9d4bbd6da
• 0bfbc6e307ddaa742463851d3de8b23624db82b55df406a900c768c4e8a74530 - 0bfbc6e307ddaa742463851d3de8b23624db82b55df406a900c768c4e8a74530
• 10dcd5b5c7406674159752dbc0cd2452bec05c25748b5af51fdb0dcb00e5fc75 - 10dcd5b5c7406674159752dbc0cd2452bec05c25748b5af51fdb0dcb00e5fc75
• 8c8a54a87c51254bca6ecc799502746ab1f5a47be8e45fda72c870e863cd4f43 - 8c8a54a87c51254bca6ecc799502746ab1f5a47be8e45fda72c870e863cd4f43
• 83f16a5dd74a2b256ac4c9d145ac4b174dbe9f8def54f5a4242621680e696610 - 83f16a5dd74a2b256ac4c9d145ac4b174dbe9f8def54f5a4242621680e696610
• 9342b9bfda6c3a9f34e6888a323c1f4ea0e1b2bf55361648b47f5e6ed3343356 - 9342b9bfda6c3a9f34e6888a323c1f4ea0e1b2bf55361648b47f5e6ed3343356
• 0fe205c1dfc385ddf0944ef1051e175a4279d6db81387e959d8376333b5b2073 - 0fe205c1dfc385ddf0944ef1051e175a4279d6db81387e959d8376333b5b2073
• fbcee87ce7b54351950109ecd948b259e3fcb5e431ef8f597a495eb333280065 - fbcee87ce7b54351950109ecd948b259e3fcb5e431ef8f597a495eb333280065
• 8676983e1cbbf1bde08d848c3952d3118c55535be5d1d46894775e4f5d70379d - 8676983e1cbbf1bde08d848c3952d3118c55535be5d1d46894775e4f5d70379d
• db0fcefc5a0d0a39cd5c50e94d1a1822b6ceb4dc33a666309d501015272bae83 - db0fcefc5a0d0a39cd5c50e94d1a1822b6ceb4dc33a666309d501015272bae83
• d8ef04114ee5954f602941fa3bc69d1f4f0aa9bd64baea1bb5da433284ad75e9 - d8ef04114ee5954f602941fa3bc69d1f4f0aa9bd64baea1bb5da433284ad75e9
• 6976d7c102c59a7d88089f847a0cfb1c8e5221e373ef5c381b490b8540e300a4 - 6976d7c102c59a7d88089f847a0cfb1c8e5221e373ef5c381b490b8540e300a4
• 78e8896611044d45b75dcbeed2594e1547aafcb2b684e92c7dac9caf3fe8fc25 - 78e8896611044d45b75dcbeed2594e1547aafcb2b684e92c7dac9caf3fe8fc25

Embedded domains

• aefd.nelreports.net

Embedded IP addresses

• 3.8.5.0

More Formbook samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report