MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16efd08d7fd6811ffa956f8ed7c4b3bbed6e90279303e0a1bbca42a6d3b3e0cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	16efd08d7fd6811ffa956f8ed7c4b3bbed6e90279303e0a1bbca42a6d3b3e0cb
SHA3-384 hash:	fe50f8947a307490d4e04ae5142d30715404cdf5c8e4bd347ae23dfe8ce3067bbe59c9d677488bad52ab8e8a01490ebd
SHA1 hash:	c4319b7c288bebb46cac0c54fc9025c786c074b4
MD5 hash:	830ab8f9dce373137467ea35a52b2189
humanhash:	moon-muppet-uncle-thirteen
File name:	Shipping Doc.js
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	984'689 bytes
First seen:	2025-05-14 06:00:13 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	24576:4ouppwtUAv+QHho3Z4m5A/sx4cxxmZYin1n+la527ogm3mhpOqa:Xaq2QMZ597XmCi1J275xOd
Threatray	18 similar samples on MalwareBazaar
TLSH	T16E2501F1D59279B05FAA6604209D3FB72DBC1DCF82907A68110C38C9F185BFABD6D5A0
Magika	javascript
Reporter	lowmal3
Tags:	FormBook js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

455

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Generic-EXE.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.PUA.Base64EXE-2.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.26270.JsHeur.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.25779.JsHeur.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.26271.JsHeur.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.25834.JsHeur.UNOFFICIAL

Alert

Create hunting rule

Js.Downloader.Agent-9914219-0

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=682432d9e16384d6a7043f8f

Tags:

dropper spawn micro

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 dropper evasive masquerade obfuscated obfuscated packed

Link:

https://www.filescan.io/uploads/682431720e63989625839859/reports/992b93b2-d4a7-4d60-a3b8-af6ffd41e5ac/overview

Hybrid Analysis GT:JS.Cbum.1

Verdict:

Malicious

Labled as:

GT:JS.Cbum.1

Link:

https://www.hybrid-analysis.com/sample/16efd08d7fd6811ffa956f8ed7c4b3bbed6e90279303e0a1bbca42a6d3b3e0cb

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1689595

Signature

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Benign windows process drops PE files

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sigma detected: Rundll32 Execution Without CommandLine Parameters

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected AntiVM3

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/16efd08d7fd6811ffa956f8ed7c4b3bbed6e90279303e0a1bbca42a6d3b3e0cb

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/16efd08d7fd6811ffa956f8ed7c4b3bbed6e90279303e0a1bbca42a6d3b3e0cb/

ReversingLabs TitaniumCloud Script-JS.Dropper.Nemucod

Threat name:

Script-JS.Dropper.Nemucod

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-14 03:39:37 UTC

File Type:

Text

AV detection:

18 of 37 (48.65%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=c3x5bdl722ar76uvn6hnprftxpww5ebhsmb6bin3zjbknu5t4dfq._file

Threatray formbook unc_loader_037

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

unc_loader_037

Alert

Create hunting rule

Similar samples:

3e6ec372972312319cb1a060b9fdd000d3ae6c00eedbd0c9599eb43ae2bcd822

Formbook

5f1cae07f4460a2eaf90b0363c946e6a4e3af969064fa1cdfb87a3ace03bdfb0

Formbook

6563c203ea1c55ed96cb4affb720c843e1c9c6b32f8a1fc6fd7d84624d346b38

Formbook

b52af535314ad644199d9804d08e7f8eea3cdbca51c06281241a3ac58365835a

Formbook

error

Formbook

f190d00b8327b3dbd653ad7aaacc15df1ccfdf4a4c780fe55249f3068df51fae

Formbook

+ 8 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery execution

Link:

https://tria.ge/reports/250514-gqe9ssvzb1/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Network Configuration Discovery: Internet Connection Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Formbook

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/16efd08d7fd6811ffa956f8ed7c4b3bbed6e90279303e0a1bbca42a6d3b3e0cb