MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29bc436d3e36f9910bb5eca219c3e2ef3c222a28f56d6dabef8f4f034e90b072. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	29bc436d3e36f9910bb5eca219c3e2ef3c222a28f56d6dabef8f4f034e90b072
SHA3-384 hash:	f1ef773ad13523628dfea0656446778bb32729aae31fdbb4e73871382129b91d7c63ec9c9d4a08af8af5abc5542d8c3c
SHA1 hash:	1d1f648969d618be4d62b4fd044af91ca18588ae
MD5 hash:	3ab41fd305eda84bd5a6b23547daa5b2
humanhash:	tennessee-coffee-fanta-december
File name:	Fiyat teklifi isteği.js
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	8'535 bytes
First seen:	2026-11-13 05:56:30 UTC
Last seen:	Never
File type:	js
MIME type:	application/javascript
ssdeep	192:m4B/Wsas4FjfAVsQchr6SWA9odpKUTiyUx:hB/WDFFjYVsVh7WA9oPjY
TLSH	T1630211886EFA602A8C3373788F2F9308F7A528175544C5617D6CA2909F34B6443E5FDD
Magika	javascript
Reporter	lowmal3
Tags:	FormBook js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

184

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af6a6b883200b505eda5721

Tags:

small crypt word

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cmd evasive lolbin powershell repaired

Link:

https://www.filescan.io/uploads/6af6a6b7b4035caf5551ef63/reports/0e903b2a-b944-475d-a41e-cf4e84fe1ce5/overview

Hybrid Analysis SVM:TrojanDownloader/JS.Nemucod

Verdict:

Malicious

Labled as:

SVM:TrojanDownloader/JS.Nemucod

Link:

https://www.hybrid-analysis.com/sample/29bc436d3e36f9910bb5eca219c3e2ef3c222a28f56d6dabef8f4f034e90b072

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

Link:

https://opentip.kaspersky.com/29bc436d3e36f9910bb5eca219c3e2ef3c222a28f56d6dabef8f4f034e90b072/results?tab=lookup

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/2005141

Signature

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

JavaScript file contains suspicious strings

JavaScript source code contains functionality to generate code involving a shell, file or stream

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected FormBook

Yara detected Generic JS Downloader

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/29bc436d3e36f9910bb5eca219c3e2ef3c222a28f56d6dabef8f4f034e90b072

Malva.RE Malware

Verdict:

Malware

YARA:

2 match(es)

Tags:

Javascript JS Emulation Trace MSXML2.XMLHTTP PowerShell Scripting.FileSystemObject T1059.007 T1105

Link:

https://app.malva.re/file/3ab41fd305eda84bd5a6b23547daa5b2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/29bc436d3e36f9910bb5eca219c3e2ef3c222a28f56d6dabef8f4f034e90b072/

ReversingLabs TitaniumCloud Text.Dropper.Generic

Threat name:

Text.Dropper.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-11-13 05:57:26 UTC

File Type:

Text (JavaScript)

AV detection:

3 of 36 (8.33%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fg6eg3j6g34zcc5v5srbtq7c546cekri6vww3k7pr5hqgtuqwbza._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261113-gnnhdsz13l/

Behaviour

Command and Scripting Interpreter: JavaScript

Reads the TCP/IP host and domain name from the registry

Badlisted process makes network request

VirusSign afec

Malware Family:

afec

Alert

Create hunting rule

Malicious:

True

Tags:

text

Link:

https://intel.virussign.com/intelligence/file/29bc436d3e36f9910bb5eca219c3e2ef3c222a28f56d6dabef8f4f034e90b072

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/29bc436d3e36f9910bb5eca219c3e2ef3c222a28f56d6dabef8f4f034e90b072