MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26ca72273622f6e166042cc2aefbb133b54069a28738cf953902ada32fb1ff65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	26ca72273622f6e166042cc2aefbb133b54069a28738cf953902ada32fb1ff65
SHA3-384 hash:	6d8b413eeaa3595740467649b95b2a29f37872deeca7606add6e49bb4e774c3929cccfd14c9813ac82417e8b8dd99a72
SHA1 hash:	c71fb6b0047634dbb990530724da11f7c9195d97
MD5 hash:	e85e3bd072750e4a377e28ffdf6dc51c
humanhash:	robert-hawaii-tennessee-delaware
File name:	EURO9083783783.JS
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	12'316'341 bytes
First seen:	2026-04-01 15:39:53 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	196608:spp/JMux+bEOoIAuvAmFQPIgcNa0j33U5iSNrINdNwfvbQxss+uunsvZbZMyR+Io:0Dz+bE2AzmFuIgqaO33Ud5+dOSshnYF4
TLSH	T179C60614D26C94BE82DEDB4CD5B1D1D05D8D20A9A98DDB1E302F91783E05FA3AB864CF
Magika	javascript
Reporter	BastianHein
Tags:	FormBook js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

118

Origin country :

CL

Vendor Threat Intelligence

ACCE

Gathering data

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69cd3c6f6363ca5d27f0a412

Tags:

n/a

Hybrid Analysis JS/Agent.DLR1

Verdict:

Suspicious

Labled as:

JS/Agent.DLR1

Link:

https://www.hybrid-analysis.com/sample/26ca72273622f6e166042cc2aefbb133b54069a28738cf953902ada32fb1ff65

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-04-01T04:36:00Z UTC

Last seen:

2026-04-01T12:13:00Z UTC

Hits:

~1000

Detections:

Trojan.JS.SAgent.sb PDM:Trojan.Win32.Generic HEUR:Trojan.PowerShell.Tesre.sb HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/26ca72273622f6e166042cc2aefbb133b54069a28738cf953902ada32fb1ff65/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/26ca72273622f6e166042cc2aefbb133b54069a28738cf953902ada32fb1ff65/

Neiki Trojan.PowerShell.Tesre

Verdict:

Malicious

Threat:

Trojan.PowerShell.Tesre

Link:

https://tip.neiki.dev/file/26ca72273622f6e166042cc2aefbb133b54069a28738cf953902ada32fb1ff65

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=e3fhejzwel3oczqeftbk565rgo2ua2ncq44m7fjzakw2gl5r75sq._file

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook execution rat spyware stealer trojan

Link:

https://tria.ge/reports/260401-s76c4ady7p/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Formbook

Formbook family

Formbook payload

VMRay FormBook

Malware family:

FormBook

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/26ca72273622/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/26ca72273622f6e166042cc2aefbb133b54069a28738cf953902ada32fb1ff65