MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 120d7d50ebb847824e9d75f3f43be30a946ead142bfbd7c434e5a87affc2b2ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	120d7d50ebb847824e9d75f3f43be30a946ead142bfbd7c434e5a87affc2b2ab
SHA3-384 hash:	cb5c7dbc8203f36b85d4fa2fd74bdd825a3e381d12c2d784f8b0d3e9546ae59dfd74b1f1138038981730006a20d34ae6
SHA1 hash:	7324461113279398bfdb18472ba057e2983d62d5
MD5 hash:	c269b570c5c359ab50c4cebe0d4ed7dd
humanhash:	one-kitten-magnesium-coffee
File name:	Invoice (1).js
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	2'085'854 bytes
First seen:	2026-07-29 08:23:29 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:wo5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5T:INI5+mco
TLSH	T19FA57CB66B5D311A7BB08BC329281870B724FD9EDC42A1EF603199C235D3EC96176C67
Magika	javascript
Reporter	proxylife
Tags:	FormBook js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

174

Origin country :

NL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm fingerprint masquerade powershell repaired

Link:

https://www.filescan.io/uploads/6a69b8c06ff0576e52043303/reports/be13f601-f39f-4921-a5c7-cc0ce639ba60/overview

Hybrid Analysis JS/TrojanDownloader.Agent

Verdict:

Suspicious

Labled as:

JS/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/120d7d50ebb847824e9d75f3f43be30a946ead142bfbd7c434e5a87affc2b2ab

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-29T07:28:00Z UTC

Last seen:

2026-07-31T00:42:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/120d7d50ebb847824e9d75f3f43be30a946ead142bfbd7c434e5a87affc2b2ab/results?tab=lookup

Nucleon Malprob Benign

Score:

12%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/120d7d50ebb847824e9d75f3f43be30a946ead142bfbd7c434e5a87affc2b2ab

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/120d7d50ebb847824e9d75f3f43be30a946ead142bfbd7c434e5a87affc2b2ab/

ReversingLabs TitaniumCloud Script-JS.Downloader.Remcos

Threat name:

Script-JS.Downloader.Remcos

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-29 08:24:48 UTC

File Type:

Binary

AV detection:

2 of 36 (5.56%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cigx2uhlxbdyetu5oxz7io7dbkkg5liufp55prbu4wuhv76cwkvq._file

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook execution rat spyware stealer trojan

Link:

https://tria.ge/reports/260729-kaz6tazamd/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Suspicious use of SetThreadContext

Badlisted process makes network request

Family: Formbook

Formbook payload

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/120d7d50ebb847824e9d75f3f43be30a946ead142bfbd7c434e5a87affc2b2ab