MALICIOUS — Form_A_BOOT.IMA

MALICIOUS — Form_A_BOOT.IMA is a unknown sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the UNOFFICIAL family. 3 of 46 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: cbf057167113f27850539352d693e0850ef59b0a647ec856723e227167007a90
• SHA-1: 9db5c18a8b50f896999789bce81f49c927001b7d
• MD5: 5beb07a7017462830243f1a17b2e830e
• ssdeep: 24576:SeVdJ91JP9jyJYNQKjHPHpV6sJqk6p95I94bqkzlHUYNBelNdlySlFQ:SQPOYNnHPJV6sVGHI94BUGelnlxQ
• TLSH: T11E572310F7985CBFC6E476512494AB3EAABF91C8744F48154DD1A3CA74B00F3A4BE09A
• Submitted as: Form_A_BOOT.IMA
• File type: unknown · Size: 1474560 bytes
• Verdict: malicious (94/100) · Family: UNOFFICIAL

Source: theZoo · first seen 2026-07-26T03:29:57.426Z · SHA-256 not source-verified

Detections (3 of 46 engines)

• capa (capabilities): beacon to command-and-control
• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): {HEX}bin.trojan.generic.form.60.UNOFFICIAL

MITRE ATT&CK

• T1071.001

Why this verdict

The malicious score of 94/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged {HEX}bin.trojan.generic.form.60.UNOFFICIAL (rule {HEX}bin.trojan.generic.form.60.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• beacon to command-and-control (rule beacon to command-and-control) - capa signal, weight 0.45, confidence 0.80
• Embedded network infrastructure: http://wbs.net/wbs.html - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Embedded URLs

• http://wbs.net/wbs.html

Embedded domains

• keyb.com
• wbs.net
• line.co.uk
• 3.fi

File paths

• C:\MSDOS
• C:\DOS
• C:\DOS\HIMEM.SYS
• C:\DOS\EMM386.EXE
• C:\WINDOWS\IFSHLP.SYS
• C:\CDD\WCD.SYS
• C:\NWCLIENT\STARTNET
• C:\WINDOWS;c:\dos
• C:\WINDOWS\TEMP
• C:\SB16
• C:\SB16\SB16SET
• C:\SB16\SBCONFIG.EXE
• c:\dos\keyb.com
• c:\dos\keyboard.sys
• c:\dos\mscdex.exe
• c:\dos\smartdrv.exe
• C:\DOS\COUNTRY.SYS
• C:\COMMAND.COM
• c:\lcs\aspi\aspi33d.sys
• c:\lcs\aspi\mdscd_as.sys
• C:\DOS\SMARTDRV.EXE
• C:\BATCH\MENU
• C:\NWCLIENT\LSL
• C:\NWCLIENT\NE2000
• C:\NWCLIENT\IPXODI

More UNOFFICIAL samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report