MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a8b0eed35de4fb233d697da4efc461f320eca06ac8cf2b2facc4de322879796. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2a8b0eed35de4fb233d697da4efc461f320eca06ac8cf2b2facc4de322879796
SHA3-384 hash:	ca17f385b88df90aa35d5892b347764c16164d59e3659382c54322a6477fe5695c262984e06cc3f5aec908e42ef4b033
SHA1 hash:	69dff2338eb9923be17aaade97d49d4f3d6e24fa
MD5 hash:	39b2af50dfb06dd24dbc920ba61752ef
humanhash:	glucose-fifteen-mockingbird-eighteen
File name:	HSBC Payment Advice.JS
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	4'189'019 bytes
First seen:	2026-09-07 17:41:52 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:i8BQR9kA8k2m5kk1o9UajEHwSRBudqkT/AeOVnGINqooJrsUcnU19+8dyR9TGXxX:i8OR9kA8k2m5kkq9UaAHwSRBMFUNeNth
TLSH	T1A3168560D77B5E327B227F5D813DC9B0B90B01431A878715B2BED2143B7E9265F04AEA
Magika	javascript
Reporter	abuse_ch
Tags:	FormBook HSBC js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

141

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.DownLoader.10820.20401.25956.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive masquerade obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a9ef7742d00e594ed04bde9/reports/70b35711-b213-45c9-93ef-64c1019b11f1/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/2a8b0eed35de4fb233d697da4efc461f320eca06ac8cf2b2facc4de322879796

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-09-07T05:18:00Z UTC

Last seen:

2026-09-08T15:25:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/2a8b0eed35de4fb233d697da4efc461f320eca06ac8cf2b2facc4de322879796/results?tab=lookup

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1969499

Signature

Found API chain indicative of debugger detection

Found direct / indirect Syscall (likely to bypass EDR)

JavaScript source code contains functionality to generate code involving a shell, file or stream

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2a8b0eed35de4fb233d697da4efc461f320eca06ac8cf2b2facc4de322879796/

ReversingLabs TitaniumCloud Script-JS.Trojan.AgentTesla

Threat name:

Script-JS.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-07 13:04:55 UTC

File Type:

Text (JavaScript)

AV detection:

12 of 23 (52.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fkfq53jv3zh3em6ws7ne57cgd4za5sqgvsgpfmx2zrg6giuhs6la._file

Threatray Formbook

Verdict:

malicious

Label(s):

Formbook

Alert

Create hunting rule

Link:

https://reports.threatray.com/5a6aed24-e5ae-43f2-b8a0-5f21e9c5378f

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook execution rat spyware stealer trojan

Link:

https://tria.ge/reports/260907-v94y6asbrb/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Family: Formbook

Formbook payload

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Formbook

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2a8b0eed35de4fb233d697da4efc461f320eca06ac8cf2b2facc4de322879796